Bug 1466694

Summary: ocf::heartbeat:apache do not move when testurl not accessible from cluster members
Product: Red Hat Enterprise Linux 7 Reporter: Strahil Nikolov <hunter86_bg>
Component: pacemakerAssignee: Ken Gaillot <kgaillot>
Status: CLOSED NOTABUG QA Contact: cluster-qe <cluster-qe>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 7.3CC: abeekhof, cluster-maint, hunter86_bg
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-06-30 19:32:03 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Strahil Nikolov 2017-06-30 09:16:21 UTC
Description of problem:
ocf::heartbeat:apache does not check the testurl and do not move the resource group to another node.

Version-Release number of selected component (if applicable):
pacemaker-1.1.15-11.el7_3.5.x86_64

How reproducible:
Always

Steps to Reproduce:
1.Create resource:
pcs resource create APACHE apache configfile="/etc/httpd/conf/httpd.conf" \
statusurl="http://127.0.0.1/server-status" client="curl" \
testurl="http://hacluster" testregex10="CLUSTER.EXAMPLE.COM"
2.Block port 80 where the webserver is served:
firewall-cmd --remove-service=80
3.Check if status url is accessible from the other nodes:
curl http://hacluster

Actual results:
Nothing.

Expected results:
Move the resource (or entire group) to another cluster node

Additional info:
'ocf::heartbeat:apache' does not start without the "statusurl" option, so they need to be used together

Comment 2 Strahil Nikolov 2017-06-30 09:18:25 UTC
In step 2 the actual command is:
firewall-cmd --remove-service=http

Comment 3 Strahil Nikolov 2017-06-30 13:30:16 UTC
It seems that the "bug"  is not a bug.Here is the actual working resource:
pcs resource create APACHE apache params \
configfile="/etc/httpd/conf/httpd.conf" testurl="/" \
testregex="CLUSTER.EXAMPLE.COM" op monitor interval=120s timeout=10s \
start-delay=5s OCF_CHECK_LEVEL=10

Comment 4 Ken Gaillot 2017-06-30 19:32:03 UTC
The testurl check is run from the same node that is running the apache resource (not from other cluster nodes), so it will succeed as long as the page is accessible locally. Most firewall configurations always allow local connections, even if the port if blocked to other hosts.

And as you figured out, a monitor must be configured with OCF_CHECK_LEVEL=10 for the apache resource agent to run the testurl check.