Bug 2095662
| Summary: | A duplicate ACL user causes a DC election loop (RHEL 8) | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Reid Wahl <nwahl> |
| Component: | pacemaker | Assignee: | Ken Gaillot <kgaillot> |
| Status: | CLOSED ERRATA | QA Contact: | cluster-qe <cluster-qe> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 8.5 | CC: | cluster-maint, cluster-qe, kgaillot, msmazova, sbradley |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 8.8 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | pacemaker-2.1.5-1.el8 | Doc Type: | Bug Fix |
| Doc Text: |
Cause: Pacemaker interprets two acl_target entries with the same id as a single entry that moved, and for a full CIB replace would start a new DC election.
Consequence: The cluster would get into an infinite DC election loop.
Fix: Moved entries in the CIB ACL section no longer start a new DC election.
Result: Duplicate acl_target ids do not cause an election loop.
|
Story Points: | --- |
| Clone Of: | 2095597 | Environment: | |
| Last Closed: | 2023-05-16 08:35:22 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | 2.1.5 |
| Embargoed: | |||
| Bug Depends On: | 2095597 | ||
| Bug Blocks: | |||
|
Description
Reid Wahl
2022-06-10 07:18:05 UTC
This was fixed by various commits upstream, which will all be in the upstream 2.1.5 release Tested using reproducer in the Description (Comment 0). before fix: ----------- > [root@virt-511 ~]# rpm -q pacemaker > pacemaker-2.1.0-8.el8.x86_64 Setup cluster: > [root@virt-511 ~]# pcs status > Cluster name: STSRHTS32383 > Cluster Summary: > * Stack: corosync > * Current DC: virt-511 (version 2.1.0-8.el8-7c3f660707) - partition with quorum > * Last updated: Wed Dec 21 11:40:35 2022 > * Last change: Tue Dec 20 17:02:06 2022 by root via cibadmin on virt-511 > * 2 nodes configured > * 2 resource instances configured > Node List: > * Online: [ virt-511 virt-515 ] > Full List of Resources: > * fence-virt-511 (stonith:fence_xvm): Started virt-511 > * fence-virt-515 (stonith:fence_xvm): Started virt-515 > Daemon Status: > corosync: active/disabled > pacemaker: active/disabled > pcsd: active/enabled Enable ACLs: > [root@virt-511 ~]# pcs acl enable > [root@virt-511 ~]# pcs acl > ACLs are enabled Save a copy of CIB and add ACLs: > [root@virt-511 ~]# pcs cluster cib > /tmp/cib.xml > [root@virt-511 ~]# vim /tmp/cib.xml Push the updated CIB: > [root@virt-511 ~]# date && pcs cluster cib-push --config /tmp/cib.xml > Wed 21 Dec 11:42:24 CET 2022 > CIB updated Check the ACLs: > [root@virt-511 ~]# cibadmin --query --scope acls > <acls> > <acl_role id="read-access"> > <acl_permission id="read-access-read" kind="read" xpath="/"/> > </acl_role> > <acl_target id="testuser"> > <role id="read-access"/> > </acl_target> > <acl_target id="testuser"> > <role id="read-access"/> > </acl_target> > </acls> > [root@virt-511 ~]# pcs acl > ACLs are enabled > User: testuser > Roles: read-access > User: testuser > Roles: read-access > Role: read-access > Permission: read xpath / (read-access-read) > [root@virt-511 ~]# Check log: > [root@virt-511 ~]# tail -f /var/log/messages > Dec 21 11:42:25 virt-511 pacemaker-controld[51510]: notice: State transition S_IDLE -> S_POLICY_ENGINE > Dec 21 11:42:25 virt-511 pacemaker-controld[51510]: notice: State transition S_ELECTION -> S_INTEGRATION > Dec 21 11:42:25 virt-511 pacemaker-controld[51510]: warning: watchdog-fencing-query failed > Dec 21 11:42:25 virt-511 pacemaker-fenced[51506]: notice: Versions did not change in patch 0.9.1 > Dec 21 11:42:25 virt-511 pacemaker-controld[51510]: notice: State transition S_ELECTION -> S_INTEGRATION > Dec 21 11:42:25 virt-511 pacemaker-controld[51510]: warning: watchdog-fencing-query failed > Dec 21 11:42:25 virt-511 pacemaker-fenced[51506]: notice: Versions did not change in patch 0.9.1 > Dec 21 11:42:25 virt-511 pacemaker-controld[51510]: notice: State transition S_ELECTION -> S_INTEGRATION > Dec 21 11:42:25 virt-511 pacemaker-controld[51510]: warning: watchdog-fencing-query failed > Dec 21 11:42:25 virt-511 pacemaker-fenced[51506]: notice: Versions did not change in patch 0.9.1 > Dec 21 11:42:25 virt-511 pacemaker-controld[51510]: notice: State transition S_ELECTION -> S_INTEGRATION > Dec 21 11:42:25 virt-511 pacemaker-controld[51510]: warning: watchdog-fencing-query failed > Dec 21 11:42:25 virt-511 pacemaker-fenced[51506]: notice: Versions did not change in patch 0.9.1 > Dec 21 11:42:25 virt-511 pacemaker-controld[51510]: notice: State transition S_ELECTION -> S_INTEGRATION > Dec 21 11:42:25 virt-511 pacemaker-controld[51510]: warning: watchdog-fencing-query failed > Dec 21 11:42:25 virt-511 pacemaker-fenced[51506]: notice: Versions did not change in patch 0.9.1 > Dec 21 11:42:25 virt-511 pacemaker-controld[51510]: notice: State transition S_ELECTION -> S_INTEGRATION > Dec 21 11:42:25 virt-511 pacemaker-controld[51510]: warning: watchdog-fencing-query failed > Dec 21 11:42:25 virt-511 pacemaker-fenced[51506]: notice: Versions did not change in patch 0.9.1 Result: An infinite DC election loop. after fix: ---------- > [root@virt-507 ~]# rpm -q pacemaker > pacemaker-2.1.5-4.el8.x86_64 Setup cluster: > [root@virt-507 ~]# pcs status > Cluster name: STSRHTS29018 > Status of pacemakerd: 'Pacemaker is running' (last updated 2022-12-19 16:54:14 +01:00) > Cluster Summary: > * Stack: corosync > * Current DC: virt-508 (version 2.1.5-4.el8-a3f44794f94) - partition with quorum > * Last updated: Mon Dec 19 16:54:15 2022 > * Last change: Mon Dec 19 16:53:54 2022 by root via cibadmin on virt-507 > * 2 nodes configured > * 2 resource instances configured > Node List: > * Online: [ virt-507 virt-508 ] > Full List of Resources: > * fence-virt-507 (stonith:fence_xvm): Started virt-507 > * fence-virt-508 (stonith:fence_xvm): Started virt-508 > Daemon Status: > corosync: active/disabled > pacemaker: active/disabled > pcsd: active/enabled Enable ACLs: > [root@virt-507 ~]# pcs acl enable > [root@virt-507 ~]# pcs acl > ACLs are enabled Save a copy of CIB and add ACLs: > [root@virt-507 ~]# pcs cluster cib > /tmp/cib.xml > [root@virt-507 ~]# vim /tmp/cib.xml Push the updated CIB: > [root@virt-507 ~]# date && pcs cluster cib-push --config /tmp/cib.xml > Mon 19 Dec 17:03:26 CET 2022 > CIB updated Check the ACLs: > [root@virt-507 ~]# cibadmin --query --scope acls > <acls> > <acl_role id="read-access"> > <acl_permission id="read-access-read" kind="read" xpath="/"/> > </acl_role> > <acl_target id="testuser"> > <role id="read-access"/> > </acl_target> > <acl_target id="testuser"> > <role id="read-access"/> > </acl_target> > </acls> > [root@virt-507 ~]# pcs acl > ACLs are enabled > User: testuser > Roles: read-access > User: testuser > Roles: read-access > Role: read-access > Permission: read xpath / (read-access-read) Check log: > [root@virt-508 ~]# tail -f /var/log/messages > Dec 19 17:03:27 virt-508 pacemaker-controld[82133]: notice: State transition S_IDLE -> S_POLICY_ENGINE > Dec 19 17:03:27 virt-508 pacemaker-schedulerd[82132]: notice: Calculated transition 7, saving inputs in /var/lib/pacemaker/pengine/pe-input-19.bz2 > Dec 19 17:03:27 virt-508 pacemaker-controld[82133]: notice: Transition 7 (Complete=0, Pending=0, Fired=0, Skipped=0, Incomplete=0, Source=/var/lib/pacemaker/pDec 19 17:03:27 virt-508 pacemaker-controld[82133]: notice: State transition S_TRANSITION_ENGINE -> S_IDLEengine/pe-input-19.bz2): Complete Results: Cluster proceeds normally, no DC election loop. marking VERIFIED in pacemaker-2.1.5-4.el8 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (pacemaker bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:2818 |