Description of problem:
I'm running a galera resource in a bundle with "op promote on-fail=block".
I'm forcing the galera server to fail during promotion, which correctly gives me a resource is FAILED state on one node, and "blocked" from restarting.

Now when doing "pcs resource cleanup galera", I can see that the failcount on the resource is correctly cleaned up:

[root@centos2 ~]# pcs resource cleanup galera                                                                                                                                                                             
Cleaning up galera:0 on galera-bundle-0, removing fail-count-galera                                                                                                                                                       
Cleaning up galera:1 on galera-bundle-1, removing fail-count-galera
Cleaning up galera:2 on galera-bundle-2, removing fail-count-galera

but the resource still shows up as "FAILED (blocked)" in pcs status.

Attached are two dumps of the CIB before the cleanup, and after the cleanup.

When diff -u the two files, I can see the following diff:
       <transient_attributes id="galera-bundle-2">                                                                                                                                                                        
         <instance_attributes id="status-galera-bundle-2">                                                                                                                                                                
-          <nvpair id="status-galera-bundle-2-fail-count-galera" name="fail-count-galera" value="1"/>                                                                                                                     
           <nvpair id="status-galera-bundle-2-last-failure-galera" name="last-failure-galera" value="1507289301"/>                                                                                                        
         </instance_attributes>                                                                                                                                                                                          
       </transient_attributes>                                                                                                                                                                                            

Showing that the fail-count is cleaned up, but apparently the last-failure is not.


Version-Release number of selected component (if applicable):
pacemaker-1.1.16-12.el7_4.3

How reproducible:
Always

Steps to Reproduce:
There might be simpler reproducer, but here's the procedure with equivalent packages from RDO and the galera resource.

On a three node cluster centos1, centos2, centos3

1. pull the container image on all nodes
  docker pull docker.io/tripleomaster/centos-binary-mariadb:passed-ci-test

2. prepare the hosts
  touch /foo # create a empty file on the host
  # install the attached galera.cnf in /etc/my.cnf.d/galera.cnf and adapt the host names 

3. create a bundle
  pcs resource bundle create galera-bundle container docker image=docker.io/tripleomaster/centos-binary-mariadb:passed-ci-test replicas=3 masters=3 network=host options="--user=root --log-driver=journald" run-command="/usr/sbin/pacemaker_remoted" network control-port=3123 storage-map id=map1 source-dir=/foo target-dir=/etc/libqb/force-filesystem-sockets options=ro storage-map id=map2 source-dir=/etc/my.cnf.d/galera.cnf target-dir=/etc/my.cnf.d/galera.cnf options=ro storage-map id=map3 source-dir=/var/lib/mysql target-dir=/var/lib/mysql options=rw --disabled

4. create the galera resource inside the bundle (adapt the host names)
  pcs resource create galera galera enable_creation=true wsrep_cluster_address='gcomm://centos1,centos2,centos3' cluster_host_map='centos1:centos1;centos2:centos2;centos3:centos3' op promote on-fail=block meta container-attribute-target=host bundle galera-bundle

5. start a first time the bundle to bootstrap the galera cluster
  pcs resource enable galera-bundle

6. once all nodes are in master, stop the bundle to stop the galera cluster
  pcs resource disable galera-bundle

7. on third node, break galera internals to force a failure at next restart
  dd if=/dev/null of=/var/lib/mysql/gvwstate.dat

8. restart the bundle and wait for the galera resource on centos3 to FAIL
  pcs resource enable galera-bundle
  

Actual results:
resource does is still blocked and out of pacemaker's control after cleanup. 

Expected results:
resource should be managed again by pacemaker (be in "Slave" state after the clean up and pacemaker should resume its scheduling). 

Additional info: