Bug 1188504

See doc text. Option needs to be added to the Admin Guide.

+++ This bug was initially created as a clone of Bug #1120858 +++

Provide an option to enable or disable fencing within a cluster through the "Fencing Policy" Configuration UI provided by BZ 1118879.

This option will enable users who are or may experience fencing storm situations to disable fencing until proper diagnostics or maintenance activities are completed.  This will enable users to shift a cluster or set of clusters into a "maintenance" mode if there will be an expected disruption to the engine instance, or the network or infrastructure components managing engine/host connectivity.

UI
--
A simple enabled/disabled option should be made available to the user within the Fencing Policy configuration tab to:
"Enable fencing operations for this cluster"
DEFAULT: Enabled

--- Additional comment from Barak on 2014-07-28 06:52:38 EDT ---

What are the implications on HA vms ?
On host level we have "disable fencing" checkbox - which means "do not run HA vms on this host" , among other things.

I assume this policy will not have any effect on the HA vms whatsoever ?

--- Additional comment from Scott Herold on 2014-07-30 11:33:53 EDT ---

Barak - I don't think this should affect running VMs.  If a user disables fencing at the cluster level, they need to assume a level of risk knowing they have HA VMs configured.  What is the current behaviour for disabling fencing at a host level? Is it possible to:

1) Start an HA VM (New or Existing) on that host
2) Live Migrate a running VM to that host

Is there a mechanism that we can "easily" use to provide a message to users when attempting a now invalid action stating "HA/Fencing is disabled for this cluster, so VM operations on HA VMs are currently limited"

--- Additional comment from Oved Ourfali on 2014-07-31 03:30:02 EDT ---

(In reply to Scott Herold from comment #2)
> Barak - I don't think this should affect running VMs.  If a user disables
> fencing at the cluster level, they need to assume a level of risk knowing
> they have HA VMs configured.  What is the current behaviour for disabling
> fencing at a host level? Is it possible to:
> 
> 1) Start an HA VM (New or Existing) on that host
> 2) Live Migrate a running VM to that host
> 

Barak - it seems like there is no such logic at the moment.
Asked both Eli and Omer regarding that.

> Is there a mechanism that we can "easily" use to provide a message to users
> when attempting a now invalid action stating "HA/Fencing is disabled for
> this cluster, so VM operations on HA VMs are currently limited"

I think we should give that as a question mark next to this setting, specifying that if you disable fencing on this cluster then HA VMs that run on a host that isn't reachable won't be restarted anywhere else.

Does that make sense?

CC-ing Doron as well, to keep him in the loop.

--- Additional comment from Oved Ourfali on 2014-08-06 09:29:55 EDT ---

In addition for that, we can add an alert saying that "Fencing is disabled on cluster XXX. HA VMs running on a non-responsive host will not be restarted elsewhere".

Scott - please ACK what's written in this comment, and in Comment #3.

--- Additional comment from Scott Herold on 2014-08-06 09:37:32 EDT ---

Ack Comment 3 and Comment 4

I really like the Cluster Alert idea.  Makes it more obvious to the user and less likely to be overlooked.