[ClusterLabs] Two node cluster without fencing and no split brain?

[Andrei Borzenkov]

On Thu, Jul 22, 2021 at 12:43 PM Jehan-Guillaume de Rorthais
<jgdr at dalibo.com> wrote:
>
> On Wed, 21 Jul 2021 12:45:40 -0400
> Digimer <lists at alteeve.ca> wrote:
>
> > On 2021-07-21 3:26 a.m., Jehan-Guillaume de Rorthais wrote:
> > > Hi,
> > >
> > > On Wed, 21 Jul 2021 04:28:30 +0000 (UTC)
> > > Strahil Nikolov via Users <users at clusterlabs.org> wrote:
> > >
> > >> Hi,
> > >> consider using a 3rd system as a Q disk. Also, you can use iscsi from that
> > >> node as a SBD device, so you will have proper fencing .If you don't have a
> > >> hardware watchdog device, you can use softdog kernel module for that. Best
> > >
> > > Having 3 nodes for quorum AND watchdog (using softdog in last resort) is
> > > enough, isn't it?
> > > But yes, having a shared storage to add a SBD device is even better.
> > >
> > > Regards,
> >
> > The third node with storage-based death is a way of creating a fence
> > configuration.
>
> Yes, poison pill.
>
> > It works because it's fencing, not because it's quorum.
>
> That's not what I said. Two node + sbd is safe. OK.
>
> My consideration/question was: 3 nodes + watchdog, without storage-based death,
> looks good enough to me. Do I miss something?
>

>From an integrity point of view it is equivalent to SBD. SBD at the
end relies on a watchdog as well. So if you have a reliable hardware
watchdog it should be OK.

>From an operational point of view pacemaker does not have the notion
of "cluster wide shutdown". Which means - as soon as you stop
pacemaker on two nodes the third node will commit suicide because it
goes out of quorum. Last man standing may help here, I have not tried
it in true three node cluster. This does not happen with SBD as long
as storage remains accessible.