RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1522858 - pcs constraint creation allows entering non-existing node name without error/verification
Summary: pcs constraint creation allows entering non-existing node name without error/...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pcs
Version: 7.2
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: Tomas Jelinek
QA Contact: cluster-qe@redhat.com
URL:
Whiteboard:
Depends On:
Blocks: 1546815
TreeView+ depends on / blocked
 
Reported: 2017-12-06 15:36 UTC by Josef Zimek
Modified: 2021-03-11 16:33 UTC (History)
9 users (show)

Fixed In Version: pcs-0.9.167-1.el7
Doc Type: Bug Fix
Doc Text:
Cause: User specifies a non-existent node when creating a location constraint. Consequence: The constraint is created but has no effect since it references a non-existent node. Fix: Warn if a node specified does not exist when creating a location constraint. Result: The user is informed the specified node does not exist. It is up to the user to decide if they made a mistake or they purposefully created a location constraint for a node they are about to add to the cluster.
Clone Of:
: 1553718 (view as bug list)
Environment:
Last Closed: 2019-08-06 13:10:01 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
proposed fix (22.02 KB, patch)
2018-11-22 13:18 UTC, Tomas Jelinek
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 3560231 0 None None None 2018-08-10 15:03:06 UTC
Red Hat Product Errata RHBA-2019:2244 0 None None None 2019-08-06 13:10:12 UTC

Description Josef Zimek 2017-12-06 15:36:39 UTC
Description of problem:

Cluster takes node names from corosync.conf. When location constraint is created with node name which is not valid (not resolvable/not reachable) constraint gets created anyway without reporting any problem. This may lead to situations where user for example creates cluster with FQDN node names and uses short names in constraint - this will result in constraint being created but ignored.


Example:

Following constraints will pass creation but has no effect on resource location:

# pcs constraint location add prefer2 rsc_id invalid_node 100


Version-Release number of selected component (if applicable):


How reproducible:
always

Steps to Reproduce:

# pcs constraint location add prefer2 rsc_id invalid_node 100


Implementing cluster node name verification and throwing error/warning about invalid node name will solve this


Actual results:
location constraint is created 

Expected results:
either resource creation fails w/ error or warning is displayed that defined node name is not resolvable by cluster

Additional info:

Comment 2 Tomas Jelinek 2017-12-07 10:45:39 UTC
Node names in corosync.conf do not matter that much. It is node names in pacemaker which matters. Thanks to this it is possible to create constraints for remote/guest nodes which only pacemaker knows about as they are configured and handled solely by pacemaker.


Now to the checking of node names.
As I mentioned recently in bz1507548 comment 2:
Pcs cannot check for hostname validity, such a check would:
a) block a possibility to create a constraint for a node which is going to be added to a cluster later
b) break backward compatibility

I see three options here:
1) Allowing creating constraints for non-existing nodes is not a bug, it is actually a required feature - see a) above
2) Allowing creating constraints for non-existing nodes is a bug, pcs should:
2a) print a warning and create a constraint
2b) exit with an error and require --force for such a constraint to be created, which breaks backward compatibility.

I understand that pcs allowing creation of constraints with non-existing nodes may be a problem. However, going with 2b, which would prevent it, may not be an option.

Josef, what do you think? Do you see any other option?

Comment 3 Josef Zimek 2017-12-07 11:08:17 UTC
Valid points, I didn't take into account pacemaker remote nodes. So if we consider creation of constraint with non-existing node name desirable i.e. for future expansion of cluster then option 2a sounds plausible to me. We should at least notify user that node defined in constraint is not known to pacemaker at the moment so user might want to double-check if it matches real node names (from pacemaker perspective) or his/her future plans.

This will prevent wrong assumptions that short names in constraint will resolve to FQDN automatically (it doesn't) yet still allow create constraint for future use.

If 2a does not create backwards compatibility issues then I would go that way. Something like this will do the trick:

"Warning: specified node name doesn't match any existing pacemaker node name: <list of valid existing pacemaker node names>. If specified node name is for node which is about to be added in future you can ignore this warning"

Comment 6 Tomas Jelinek 2018-11-22 13:18:33 UTC
Created attachment 1507939 [details]
proposed fix

Test:
[root@rh76-node1:~]# pcs status nodes
Pacemaker Nodes:
 Online: rh76-node1 rh76-node2
 Standby:
 Maintenance:
 Offline:
Pacemaker Remote Nodes:
 Online:
 Standby:
 Maintenance:
 Offline:
[root@rh76-node1:~]# pcs resource
 d1     (ocf::pacemaker:Dummy): Started rh76-node2
 d2     (ocf::pacemaker:Dummy): Started rh76-node1
[root@rh76-node1:~]# pcs constraint location
Location Constraints:
[root@rh76-node1:~]# pcs constraint location add loc-con1 d1 unknown_node 123
Warning: Node 'unknown_node' does not seem to be in the cluster. If you are about to add node 'unknown_node' to the cluster, you can safely ignore this warning.
[root@rh76-node1:~]# echo $?
0
[root@rh76-node1:~]# pcs constraint location add loc-con2 d1 rh76-node1 111
[root@rh76-node1:~]# echo $?
0
[root@rh76-node1:~]# pcs constraint location d1 prefers unknown_node2=321
Warning: Node 'unknown_node2' does not seem to be in the cluster. If you are about to add node 'unknown_node2' to the cluster, you can safely ignore this warning.
[root@rh76-node1:~]# echo $?
0
[root@rh76-node1:~]# pcs constraint location d1 avoids unknown_node3
Warning: Node 'unknown_node3' does not seem to be in the cluster. If you are about to add node 'unknown_node3' to the cluster, you can safely ignore this warning.
[root@rh76-node1:~]# echo $?
0
[root@rh76-node1:~]# pcs constraint location
Location Constraints:
  Resource: d1
    Enabled on: unknown_node (score:123)
    Enabled on: rh76-node1 (score:111)
    Enabled on: unknown_node2 (score:321)
    Disabled on: unknown_node3 (score:-INFINITY)

Comment 8 Ivan Devat 2019-03-21 10:08:54 UTC
After Fix:

[kid76 ~] $ rpm -q pcs
pcs-0.9.167-1.el7.x86_64

[kid76 ~] $ pcs status nodes
Pacemaker Nodes:
 Online: kid76 lion76
 Standby:
 Maintenance:
 Offline:
Pacemaker Remote Nodes:
 Online:
 Standby:
 Maintenance:
 Offline:
[kid76 ~] $ pcs resource
 R      (ocf::heartbeat:Dummy): Started kid76
[kid76 ~] $ pcs constraint location
Location Constraints:
[kid76 ~] $ pcs constraint location add L R UNKNOWN_NODE 123
Warning: Node 'UNKNOWN_NODE' does not seem to be in the cluster. If you are about to add node 'UNKNOWN_NODE' to the cluster, you can safely ignore this warning.
[kid76 ~] $ echo $?
0
[kid76 ~] $ pcs constraint location add L2 R lion76 111
[kid76 ~] $ echo $?
0
[kid76 ~] $ pcs constraint location R prefers UNKNOWN_NODE2=321
Warning: Node 'UNKNOWN_NODE2' does not seem to be in the cluster. If you are about to add node 'UNKNOWN_NODE2' to the cluster, you can safely ignore this warning.
[kid76 ~] $ echo $?
0
[kid76 ~] $ pcs constraint location R avoids UNKNOWN_NODE3
Warning: Node 'UNKNOWN_NODE3' does not seem to be in the cluster. If you are about to add node 'UNKNOWN_NODE3' to the cluster, you can safely ignore this warning.
[kid76 ~] $ echo $?
0
[kid76 ~] $ pcs constraint location
Location Constraints:
  Resource: R
    Enabled on: UNKNOWN_NODE (score:123)
    Enabled on: lion76 (score:111)
    Enabled on: UNKNOWN_NODE2 (score:321)
    Disabled on: UNKNOWN_NODE3 (score:-INFINITY)

Comment 12 errata-xmlrpc 2019-08-06 13:10:01 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2244


Note You need to log in before you can comment on or make changes to this bug.