Bug 826022

Summary:	sanlock: should support graceful release of resources
Product:	Red Hat Enterprise Linux 6	Reporter:	Federico Simoncelli <fsimonce>
Component:	sanlock	Assignee:	David Teigland <teigland>
Status:	CLOSED ERRATA	QA Contact:	Leonid Natapov <lnatapov>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	6.4	CC:	abaron, berrange, cluster-maint, cpelland, fsimonce, teigland
Target Milestone:	rc	Keywords:	FutureFeature, ZStream
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	storage
Fixed In Version:	sanlock-2.5-1.el6	Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:
Clones:	829316 (view as bug list)		Environment:
Last Closed:	2013-02-21 08:52:37 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	829316, 840953, 906027

Description Federico Simoncelli 2012-05-29 12:01:44 UTC

Description of problem:
At the moment the only supported way of fencing a process that lost its resources (lockspace unreachable) is killing the pid with SIGTERM/SIGKILL. Looking forward we want support a graceful interaction between sanlock and the monitored process.

Use case:

In oVirt sanlock is used to acquire the volumes (disks) resources for a qemu-kvm process. If the storage domain is unreacheable (lockspace) sanlock is terminating the qemu-kvm process. The graceful way of handling the situation is to interact with the qemu-kvm process (probably a script that connects to libvirt) and pauses the guest.

When the storage is reachable again it's the manager's responsibility (vdsm) to reacquire the lockspace, reacquire the volume resources for the qemu process (checking the lver value to make sure that they haven't changed), and unpause the guest.

The benefit is that during the storage domain down time the VM isn't killed but simply paused.

Possible implementation:
Define a new API to configure a script (per monitored process) to be used for the graceful release of resources.
If the script fails we should escalate to SIGTERM/SIGKILL and ultimately to the dogwatch host fencing.

Comment 5 David Teigland 2012-07-17 14:58:40 UTC

I know only in general how this will be used, Federico would have some more specific instructions.  The idea is that when a host looses access to the storage in a storage domain, the vm's will be suspended, rather than killed like they are now.  When the host regains access to the storage, the vm's will be resumed.

Comment 10 errata-xmlrpc 2013-02-21 08:52:37 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0530.html