how to fence cluster members when using virtualized HBAs
 

Hi everybody,

when deploying bare-metal RHEL Clusters there is the problem of fencing; powering down a physical machine seems like a good idea, but when "somebody" re-starts the machine your data will get corrupted on-the-fly because the booting machine lights up the HBA, LUNs get mounted and misery starts.

To get around that some organizations use a fencing script that shuts down the interface on the SAN switch to which the HBA is physically connected. This script runs of course on the node that considers itself as the survivor and is controlled by the RHEL ditributed lock manager (DLM) I think. From that moment onwards the failed node can boot as much as it likes, it will not have access to the LUNs.

How can something similar be achieved in this marvellous world of virtualization, where both NICs and HBAs have been virtualized?

Has anybody done this for virtualized HBAs?

Does anybody know of storm control in the sense that all clustered VMs on a failed server will fail-over?

This is for application code, not for Oracle RAC.

Normally, those VMs don't have HBas, all they have are hard drives, that are in fact LUNs, files or LVs on the SAN. So that really, all you need to do is keep the standard auto-zoning practice with the hardware.

Having said that, there are technologies like PCI passthrough, VMFEX, SRIOV and so on, that actually pass a physical or semi-physical HBA to a VM directly. In this case, you acan really use that HBA's WWID and do the auto-zoning, just like you would have on a regular host. There should be no real difference.

BTW, in normal modern systems, there should be no need for auto-zoning, because the cluster mechanism is the authority that handles mounts or LV activations on nodes, and the fact that a host booted up seeing a LUN doesn't mean it will mount and start using the LUN directly.