Bug 1693364

HA web UI is a nice feature not a lot of people know of (I think). On top of that, there was an issue reported recently related to it (se bz links in the text bellow). So it would be good to document it (for both RHEL 7 and RHEL 8). Description and explanation of the feature follows. Feel free to restructure it as you need for it to fit existing docs. My goal is to provide you enough info about the feature. As always, let me know if you have any questions.


If a user is managing a cluster using web UI and the node they run the web UI on goes down, the user must manually change URL in their browser to connect to web UI on another node. As a solution, pcsd web UI is HA since RHEL 7.2 (bz1158577).


The HA web UI feature consists of several parts:

1) pcsd config files syncing
Pcsd automatically synces its config files across its local cluster. Therefore it does not matter which node's web UI a user accesses, they all have the same settings, imported clusters etc.

2) virtual IP for accessing the web UI in an HA manner
Let's say a cluster consists of nodes nodeA, nodeB, nodeC and a user accesses web UI on nodeA. When nodeA goes down, the user must change URL in their browser to either nodeB or nodeC.
To prevent this, the user can create a virtual IP resource and use it to connect to pcsd in a running cluster. When the node the virtual IP is running on goes down, pacemaker migrates the IP to another node. The user is automatically reconnected to the new node without any manual intervention. They have to log in to pcsd, though, because sessions are not shared between the nodes for security reasons.

3) pcsd SSL certificate syncing
When the pcsd virtual IP moves to a new node and that node has a different pcsd SSL certificate than the first one, browsers do not communicate with the web UI on the new node for security reasons. To overcome this, pcsd synchronizes its certificate across its local cluster when creating a cluster or adding a new node.
This, however, is not ideal from security point of view. See bz1673822 and bz1665898. It is highly recommended for users to create their own certificates for pcsd and make them valid for all nodes. To achieve that, they can either use wildcard certificates or specify Subject Alternative Name. (Creating such certificates is out of scope of pcs docs, I would say. And I guess it is described somewhere already, so a link for that doc could be added.)
Installing custom certificates to pcsd is already documented somewhere, I think. 'pcs pcsd certkey' and 'pcs pcsd sync-certificates' are the commands for that.


How to setup HA pcsd web UI:
* Create a virtual IP resource
* Make sure all nodes have the same pcsd SSL certificate.
* Connect to the web UI using the virtual IP.



Now, due to issues mentioned in step 3, changes have been made to the certs syncing:

RHEL 7 (bz1665898):
* The syncing is enabled by default. (No change here, actually.)
* It can be disabled by setting PCSD_SSL_CERT_SYNC_ENABLED to false in /etc/sysconfig/pcsd

RHEL 8 (bz1673822):
* The syncing is disabled by default.
* It can be enabled by setting PCSD_SSL_CERT_SYNC_ENABLED to true in /etc/sysconfig/pcsd