Skip to content

Commit 80b166b

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #285551 from dennispadia/dp-sles
Changes in SLES document to address Fence Agent issue after update
2 parents 5a6d7b3 + 5840456 commit 80b166b

File tree

1 file changed

+43
-27
lines changed

1 file changed

+43
-27
lines changed

‎articles/sap/workloads/high-availability-guide-suse-pacemaker.md

Lines changed: 43 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.service: sap-on-azure
88
ms.subservice: sap-vm-workloads
99
ms.topic: article
1010
ms.custom: devx-track-azurepowershell, linux-related-content
11-
ms.date: 04/08/2024
11+
ms.date: 08/26/2024
1212
ms.author: radeltch
1313
---
1414

@@ -640,10 +640,16 @@ Make sure to assign the custom role to the service principal at all VM (cluster
640640
```
641641
642642
> [!NOTE]
643-
> On SLES 15 SP4 check the version of *crmsh* and *pacemaker* package, and make sure that the miniumum version requirements are met:
644643
>
645-
> - crmsh-4.4.0+20221028.3e41444-150400.3.9.1 or later
646-
> - pacemaker-2.1.2+20211124.ada5c3b36-150400.4.6.1 or later
644+
> For **SLES 15 SP4**, verify the versions of the `crmsh` and `pacemaker` packages to ensure they meet the minimum version requirements:
645+
>
646+
> - `crmsh-4.4.0+20221028.3e41444-150400.3.9.1` or later
647+
> - `pacemaker-2.1.2+20211124.ada5c3b36-150400.4.6.1` or later
648+
649+
> [!IMPORTANT]
650+
>
651+
> - **SLES 12 SP5:** If python-azure-core-1.23.1-**2.12.8** is installed, the Azure fence agent may fail to start in a Pacemaker cluster, displaying the error message “Azure Resource Manager Python SDK not found or not accessible” in /var/log/messages. Follow the instructions in [SUSE KBA 21532](https://www.suse.com/support/kb/doc/?id=000021532) for more details.
652+
> - **SLES 15 SP4+:** After updating the OS, the Azure libraries for Python might use the Python 3.11 interpreter, causing the Azure fence agent to fail to start in a Pacemaker cluster. The error message “Azure Resource Manager Python SDK not found or not accessible” will appear in /var/log/messages. Follow the instructions in [SUSE KBA 21504](https://www.suse.com/support/kb/doc/?id=000021504) for more details.
647653
648654
2. **[A]** Install the component, which you need for the cluster resources.
649655
@@ -770,20 +776,30 @@ Make sure to assign the custom role to the service principal at all VM (cluster
770776
>
771777
> Earlier versions will not work correctly with a managed identity configuration.
772778

773-
10. **[A]** Install the Azure Python SDK and Azure Identity Python module.
779+
10. **[A]** Install fence-agents-azure-arm package.
774780

775-
Install the Azure Python SDK on SLES 12 SP4 or SLES 12 SP5:
781+
For **SLES 12 SP5**, if you are using `fence-agents` version `4.9.0+git.1624456340.8d746be9-3.41.3` or later, and for **SLES 15 SP4 and newer**, you need to install the `fence-agents-azure-arm` package. This package will include all required dependencies.
776782

777783
```bash
778-
# You might need to activate the public cloud extension first
784+
# On SLES 12 SP5 with fence-agents version 4.9.0+git.1624456340.8d746be9-3.41.3 or higher. You might need to activate the public cloud extension first
779785
SUSEConnect -p sle-module-public-cloud/12/x86_64
780-
sudo zypper install python-azure-mgmt-compute
781-
sudo zypper install python-azure-identity
786+
sudo zypper install fence-agents-azure-arm
787+
788+
# On SLES 15 SP4 and later. You might need to activate the public cloud extension first. In this example, the SUSEConnect
789+
SUSEConnect -p sle-module-public-cloud/15.4/x86_64
790+
sudo zypper install fence-agents-azure-arm
782791
```
783792

784-
Install the Azure Python SDK on SLES 15 or later:
793+
11. **[A]** Install the Azure Python SDK and Azure Identity Python module.
794+
795+
For **SLES 12 SP5**, if your `fence-agents` version is lower then `4.9.0+git.1624456340.8d746be9-3.41.3`, and for **SLES 15 SP3 and below**, you need to install below additional packages.
785796

786797
```bash
798+
# You might need to activate the public cloud extension first
799+
SUSEConnect -p sle-module-public-cloud/12/x86_64
800+
sudo zypper install python-azure-mgmt-compute
801+
sudo zypper install python-azure-identity
802+
787803
# You might need to activate the public cloud extension first. In this example, the SUSEConnect command is for SLES 15 SP1
788804
SUSEConnect -p sle-module-public-cloud/15.1/x86_64
789805
sudo zypper install python3-azure-mgmt-compute
@@ -795,10 +811,10 @@ Make sure to assign the custom role to the service principal at all VM (cluster
795811
> You can check the extension by running `SUSEConnect ---list-extensions`.
796812
> To achieve the faster failover times with the Azure fence agent:
797813
>
798-
> - On SLES 12 SP4 or SLES 12 SP5, install version 4.6.2 or later of the *python-azure-mgmt-compute* package.
814+
> - On SLES 12 SP5, install version 4.6.2 or later of the *python-azure-mgmt-compute* package.
799815
> - If your *python-azure-mgmt-compute or python**3**-azure-mgmt-compute* package version is 17.0.0-6.7.1, follow the instructions in [SUSE KBA](https://www.suse.com/support/kb/doc/?id=000020377) to update the fence-agents version and install the Azure Identity client library for Python module if it is missing.
800816

801-
11. **[A]** Set up the hostname resolution.
817+
12. **[A]** Set up the hostname resolution.
802818

803819
You can either use a DNS server or modify the */etc/hosts* file on all nodes. This example shows how to use the */etc/hosts* file.
804820

@@ -822,7 +838,7 @@ Make sure to assign the custom role to the service principal at all VM (cluster
822838
10.0.0.7 prod-cl1-1
823839
```
824840

825-
12. **[1]** Install the cluster.
841+
13. **[1]** Install the cluster.
826842

827843
- If you're using SBD devices for fencing (for either the iSCSI target server or Azure shared disk):
828844
@@ -851,7 +867,7 @@ Make sure to assign the custom role to the service principal at all VM (cluster
851867
# Do you wish to configure an administration IP (y/n)? n
852868
```
853869

854-
13. **[2]** Add the node to the cluster.
870+
14. **[2]** Add the node to the cluster.
855871

856872
```bash
857873
sudo crm cluster join
@@ -861,13 +877,13 @@ Make sure to assign the custom role to the service principal at all VM (cluster
861877
# /root/.ssh/id_rsa already exists - overwrite (y/n)? n
862878
```
863879

864-
14. **[A]** Change the hacluster password to the same password.
880+
15. **[A]** Change the hacluster password to the same password.
865881

866882
```bash
867883
sudo passwd hacluster
868884
```
869885

870-
15. **[A]** Adjust the corosync settings.
886+
16. **[A]** Adjust the corosync settings.
871887

872888
```bash
873889
sudo vi /etc/corosync/corosync.conf
@@ -949,14 +965,14 @@ Make sure to assign the custom role to the service principal at all VM (cluster
949965
#### [Managed identity](#tab/msi)
950966

951967
```bash
952-
# Adjust the command with your subscription ID and resource group of the VM
968+
# Adjust the command with your subscription ID and resource group of the VM
953969
954-
sudo crm configure primitive rsc_st_azure stonith:fence_azure_arm \
955-
params msi=true subscriptionId="subscription ID" resourceGroup="resource group" \
956-
pcmk_monitor_retries=4 pcmk_action_limit=3 power_timeout=240 pcmk_reboot_timeout=900 pcmk_delay_max=15 pcmk_host_map="prod-cl1-0:prod-cl1-0-vm-name;prod-cl1-1:prod-cl1-1-vm-name" \
957-
op monitor interval=3600 timeout=120
970+
sudo crm configure primitive rsc_st_azure stonith:fence_azure_arm \
971+
params msi=true subscriptionId="subscription ID" resourceGroup="resource group" \
972+
pcmk_monitor_retries=4 pcmk_action_limit=3 power_timeout=240 pcmk_reboot_timeout=900 pcmk_delay_max=15 pcmk_host_map="prod-cl1-0:prod-cl1-0-vm-name;prod-cl1-1:prod-cl1-1-vm-name" \
973+
op monitor interval=3600 timeout=120
958974
959-
sudo crm configure property stonith-timeout=900
975+
sudo crm configure property stonith-timeout=900
960976
```
961977

962978
#### [Service principal](#tab/spn)
@@ -972,7 +988,7 @@ Make sure to assign the custom role to the service principal at all VM (cluster
972988
sudo crm configure property stonith-timeout=900
973989
```
974990

975-
---
991+
---
976992

977993
If you're using fencing device, based on service principal configuration, read [Change from SPN to MSI for Pacemaker clusters using Azure fencing](https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-high-availability-change-from-spn-to-msi-for/ba-p/3609278) and learn how to convert to managed identity configuration.
978994
@@ -1035,11 +1051,11 @@ Azure offers [scheduled events](/azure/virtual-machines/linux/scheduled-events).
10351051
Important: The resources must start with 'health-azure'.
10361052
10371053
```bash
1038-
sudo crm configure primitive health-azure-events ocf:heartbeat:azure-events-az \
1039-
meta allow-unhealthy-nodes=true failure-timeout=120s \
1040-
op start start-delay=60s \
1054+
sudo crm configure primitive health-azure-events ocf:heartbeat:azure-events-az \
1055+
meta allow-unhealthy-nodes=true failure-timeout=120s \
1056+
op start start-delay=60s \
10411057
op monitor interval=10s
1042-
1058+
10431059
sudo crm configure clone health-azure-events-cln health-azure-events
10441060
```
10451061

0 commit comments

Comments
 (0)