Skip to content

Commit 592cb3a

Browse files
author
rdeltcheva
committed
Add link to blog on how to convert to MSI based fence device, other minor
1 parent 37fbfb0 commit 592cb3a

File tree

2 files changed

+8
-6
lines changed

2 files changed

+8
-6
lines changed

articles/virtual-machines/workloads/sap/high-availability-guide-rhel-pacemaker.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -320,15 +320,15 @@ op monitor interval=3600
320320

321321
#### [Service Principal](#tab/spn)
322322

323-
For RHEL **7.X**, use the following command to configure the fence device:
323+
For RHEL **7.x**, use the following command to configure the fence device:
324324
<pre><code>sudo pcs stonith create rsc_st_azure fence_azure_arm login="<b>login ID</b>" passwd="<b>password</b>" \
325325
resourceGroup="<b>resource group</b>" tenantId="<b>tenant ID</b>" subscriptionId="<b>subscription id</b>" \
326326
<b>pcmk_host_map="prod-cl1-0:prod-cl1-0-vm-name;prod-cl1-1:prod-cl1-1-vm-name"</b> \
327327
power_timeout=240 pcmk_reboot_timeout=900 pcmk_monitor_timeout=120 pcmk_monitor_retries=4 pcmk_action_limit=3 pcmk_delay_max=15 \
328328
op monitor interval=3600
329329
</code></pre>
330330

331-
For RHEL **8.X**, use the following command to configure the fence device:
331+
For RHEL **8.x**, use the following command to configure the fence device:
332332
<pre><code>sudo pcs stonith create rsc_st_azure fence_azure_arm username="<b>login ID</b>" password="<b>password</b>" \
333333
resourceGroup="<b>resource group</b>" tenantId="<b>tenant ID</b>" subscriptionId="<b>subscription id</b>" \
334334
<b>pcmk_host_map="prod-cl1-0:prod-cl1-0-vm-name;prod-cl1-1:prod-cl1-1-vm-name"</b> \
@@ -338,7 +338,7 @@ op monitor interval=3600
338338

339339
---
340340

341-
If you are using fencing device, based on Service Principal configuration, read [Change from SPN to MSI for Pacemaker clusters using Azure fencing](https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-high-availability-change-from-spn-to-msi-for/ba-p/3609278) and learn how to convert to managed identity configuration.
341+
If you are using fencing device, based on service principal configuration, read [Change from SPN to MSI for Pacemaker clusters using Azure fencing](https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-high-availability-change-from-spn-to-msi-for/ba-p/3609278) and learn how to convert to managed identity configuration.
342342

343343
> [!TIP]
344344
> Only configure the `pcmk_delay_max` attribute in two node Pacemaker clusters. For more information on preventing fence races in a two node Pacemaker cluster, see [Delaying fencing in a two node cluster to prevent fence races of "fence death" scenarios](https://access.redhat.com/solutions/54829).

articles/virtual-machines/workloads/sap/high-availability-guide-suse-pacemaker.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ms.topic: article
1313
ms.tgt_pltfrm: vm-windows
1414
ms.workload: infrastructure-services
1515
ms.custom: subject-rbac-steps
16-
ms.date: 08/30/2022
16+
ms.date: 09/22/2022
1717
ms.author: radeltch
1818

1919
---
@@ -472,7 +472,7 @@ This section applies only if you want to use a fencing device with an Azure fenc
472472
This section applies only if you're using a fencing device that's based on an Azure fence agent. The fencing device uses either a managed identity or a service principal to authorize against Microsoft Azure.
473473

474474
#### Using managed identity
475-
To create a managed identity (MSI), [create a system-assigned](/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm#system-assigned-managed-identity) managed identity for each VM in the cluster. Should a system-assigned managed identity already exist, it will be used. User assigned managed identities should not be used with Pacemaker at this time.
475+
To create a managed identity (MSI), [create a system-assigned](/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm#system-assigned-managed-identity) managed identity for each VM in the cluster. Should a system-assigned managed identity already exist, it will be used. User assigned managed identities should not be used with Pacemaker at this time. Fence device, based on managed identity is supported on SLES 15 SP1 and above.
476476

477477
#### Using service principal
478478

@@ -640,7 +640,7 @@ Make sure to assign the custom role to the service principal at all VM (cluster
640640
641641
>[!IMPORTANT]
642642
> If using managed identity, the installed version of the *fence-agents* package must be fence-agents 4.5.2+git.1592573838.1eee0863 or later. Earlier versions will not work correctly with a managed identity configuration.
643-
> Currently only SLES 15 SP1 and older are supported for managed identity configuration.
643+
> Currently only SLES 15 SP1 and newer are supported for managed identity configuration.
644644
645645
1. **[A]** Install the Azure Python SDK and Azure Identity Python module.
646646

@@ -823,6 +823,8 @@ Make sure to assign the custom role to the service principal at all VM (cluster
823823
sudo crm configure property stonith-timeout=900
824824
</code></pre>
825825

826+
If you are using fencing device, based on service principal configuration, read [Change from SPN to MSI for Pacemaker clusters using Azure fencing](https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-high-availability-change-from-spn-to-msi-for/ba-p/3609278) and learn how to convert to managed identity configuration.
827+
826828
> [!IMPORTANT]
827829
> The monitoring and fencing operations are deserialized. As a result, if there's a longer-running monitoring operation and simultaneous fencing event, there's no delay to the cluster failover because the monitoring operation is already running.
828830

0 commit comments

Comments
 (0)