[DRBD-user] DRBD 9 Primary-Secondary, Pacemaker, and STONITH

[Robert Altnoeder]

On 11/14/18 2:58 AM, Igor Cicimov wrote:
> On Wed, Nov 14, 2018 at 8:31 AM Bryan K. Walton
> <bwalton+1539795345 at leepfrog.com> wrote:
>> I don't understand this.  If the power fails to a node, then won't the
>> node, by definition be down (since there is no power going to the node)?
>> So, how then could there be a split brain when one node has no power?
> And how is the other node suppose to know that it's peer crashed due
> to power failure? From it's stand point the node disappeared and it
> has to attempt to STONITH. Now, if the STONITH device on the other
> side gets it's power via the same supply as the server then STONITH is
> not possible because the stonith device itself will be powered down
> too. You see the problem now?

That is exactly the problem.
>> Is the above quote stating that if Pacemaker can't confirm that one
>> node has been STONITHed, that it won't allow the remaining node to work,
>> either?

At least in the default configuration, if fencing fails, the cluster
freezes. The cluster does not stop anything that is already running on
some other node, but it will also not start any services that are not
running (e.g. those that were running on the node that is probably down).
This situation continues until either a fencing retry succeeds, or until
an operator manually confirms to the cluster that the node the cluster
was trying to fence is down.

br,
Robert