Created attachment 1457154 [details]
debug start of iSCSILogicalUnit resource and cluster backup

Description of problem:
iSCSILogicalUnit fails to start the resource from the first time with the error 'This NodeACL already exists in configFS' once the resource has failed on all nodes and the resource got clear && cleanup - the resource starts successfully.

Version-Release number of selected component (if applicable):
corosync-2.4.3-2.el7_5.1.x86_64
corosynclib-2.4.3-2.el7_5.1.x86_64
pacemaker-1.1.18-11.el7_5.3.x86_64
pacemaker-cli-1.1.18-11.el7_5.3.x86_64
pacemaker-cluster-libs-1.1.18-11.el7_5.3.x86_64
pacemaker-libs-1.1.18-11.el7_5.3.x86_64
resource-agents-3.9.5-124.el7.x86_64
targetcli-2.1.fb46-6.el7_5.noarch


How reproducible:
Always

Steps to Reproduce:
1. Disable firewall or allow port 7000/tcp
2. Set selinux to permissive
3. Configure 3 nodes with drbd and test them prior to setting it up in the cluster configuration:
3.1. Create drbd0 config file:
# cat /etc/drbd.d/drbd0.res 
resource drbd0 {
protocol C;
net {
        cram-hmac-alg sha1;
        shared-secret "SomePass";
}

 
volume 0 {
	device /dev/drbd0;
	disk /dev/drbd/drbd0;
	meta-disk internal;
}
 
on drbd1 {
	address 192.168.122.48:7000;
	node-id 1;
}
on drbd2 {
	address 192.168.122.49:7000;
	node-id 2;
}
on drbd3 {
	address 192.168.122.50:7000;
	node-id 3;
}
 
connection-mesh {
  hosts drbd1 drbd2 drbd3;
}
 
}

3.2 Prepare local storage for drbd on all nodes: 
drbdadm create-md drbd0
drbdadm up drbd0
3.3 Make one node primary for initial sync:
drbdadm primary --force drbd0

4.Configure the cluster by using the "pcs config restore cluster.bkp.tar.bz2" -> provided in the attached zip file


Actual results:
iSCSILogicalUnit fails to start properly.Manual intervention is needed via:
'pcs resource clear iscsi-lun0 && pcs resource cleanup iscsi-lun0'.
Once the nodes get rebooted -> they need to fail starting the resource and cleaned up again.

Expected results:
iSCSILogictalUnit to work as expected

Additional info:
I'm attaching the cluster config backup and output of the debug-start generated via:
pcs resource disable iscsi-lun0
#export OCF_ROOT=/usr/lib/ocf
#export OCF_RESKEY_allowed_initiators='iqn.2018-01.com.example:client01'
#export OCF_RESKEY_lun=0
#export OCF_RESKEY_path=/dev/drbd0
#export OCF_RESKEY_target_iqn='iqn.2018-01.com.example:centos'
#bash -x /usr/lib/ocf/resource.d/heartbeat/iSCSILogicalUnit start