-
-
Notifications
You must be signed in to change notification settings - Fork 14k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
nixos/pacemaker: updates to allow ocf:heartbeat:IPaddr2 to function #208298
base: master
Are you sure you want to change the base?
Conversation
Fix might be a bit blunt but without it it cannot write/update to the /var/lib/pacemaker/cib/ directory and fails to come up. There might be a better systemd way to do this but for now this seems serviceable.
Added/refactored pacemaker tests to test for vip IPaddr2 resource usage. Future work might be to wrap the config into nixos module options for corosync. Other ocfs:heartbeat:* resources might need similar work and/or tests added. For now I only validated IPaddr2 as thats what I need. I also punted on linking the vip to the cat test resource for now and simply ping the vip address in the test to see if it is moving or not.
Should I do anything more here to get this merged into master? Its kinda useful for a basic pacemaker setup that moves vips around and the unit tests added should convey that. |
serviceConfig = { | ||
ExecStartPost = "${pkgs.coreutils}/bin/chown -R hacluster:pacemaker /var/lib/pacemaker"; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why is this necessary? Shouldn’t the tmpfilesd rule above handle this?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I can't recall been a year let me see if its still needed,could be detritus from testing.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ok so its not "technically" needed but what can happen is if the main daemon running as root saves the current configuration in the event of a separate node failure, the pengine backup could get saved as root and not pacemaker and causes pacemaker to die when it tries to start and read the prior configuration after fork() in one of the children processes.
I can't seem to get it to replicate though so maybe it was a bug in earlier versions? But basically that was the rationale its less systemd and more the interaction of the daemon and its children that run as the hacluster user. I could swap it to just be a find and to find any non user owned files in the state dir and chown only those this is a bit sledgehammery.
Description of changes
Adds updates to pacemaker nixos module and ocf-resource-agents to allow the IPaddr2 resource to function at least under pacemaker theoretically should fix other users of those resource agents too but that is untested.
Updated the pacemaker tests to also add a vip resource and for both the cat resource and vip resource ensure that a systemctl restart pacemaker works, and also that afterwards the resources migrate. As well as a subsequent crash of the node migrates resources as well.
For now the vip is only pinged after a restart or vm crash, future updates could tie both the vip and the netcat resources together but it is largely unnecessary for these tests as they exist today.
Things done
sandbox = true
set innix.conf
? (See Nix manual)nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"
. Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/
)nixos/doc/manual/md-to-db.sh
to update generated release notesFixes: #207891