RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1285946 - fence_compute only controls compute nodes
Summary: fence_compute only controls compute nodes
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: fence-agents
Version: 7.2
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Marek Grac
QA Contact: cluster-qe@redhat.com
Depends On:
Blocks: 1185030
TreeView+ depends on / blocked
Reported: 2015-11-27 02:56 UTC by Andrew Beekhof
Modified: 2016-11-21 16:28 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2015-12-01 03:24:02 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description Andrew Beekhof 2015-11-27 02:56:01 UTC
Description of problem:

fence_compute currently claims to be able to fence control nodes.
This is quite dangerous.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Deploy openstack
2. Deploy instance HA using the instructions at https://access.redhat.com/articles/1544823
3. Run:

   fence_compute -l admin -p ${pass} -t admin --record-only -k http://${ip}:5000/v2.0/ -o status -n overcloud-controller-0; echo $?

Results without patch:


Results with patch:


Additional info:

--- /sbin/fence_compute.orig	2015-11-26 20:09:12.165071987 -0500
+++ /sbin/fence_compute	2015-11-26 21:53:20.724927251 -0500
@@ -7,6 +7,7 @@
 import requests.exceptions
+from subprocess import *
 from fencing import *
 from fencing import fail_usage, is_executable, run_command, run_delay
@@ -222,9 +223,15 @@
 			set_attrd_status(options["--plug"], "yes", options)
-		elif options["--action"] in ["status", "monitor"]:
+		elif options["--action"] == "monitor":
+		elif options["--action"] == "status":
+			role=Popen(['crm_attribute', '-N', options["--plug"], '-n', 'osprole', '-d', 'unknown', '-q'], stdout=PIPE).communicate()[0].strip()
+			if role == "compute":
+				sys.exit(0)
+			sys.exit(1)
 	# The first argument is the Nova client version
 	nova = nova_client.Client('2',

Comment 1 Andrew Beekhof 2015-12-01 03:24:02 UTC
Not an issue if the fencing device points at the overcloud instead of the undercloud.
Control nodes wont even be in the list.

Note You need to log in before you can comment on or make changes to this bug.