Skip to content

Commit e5926ed

Browse files
author
rdeltcheva
committed
Adjustments for RHEL 9.0
1 parent ab24b29 commit e5926ed

File tree

1 file changed

+8
-7
lines changed

1 file changed

+8
-7
lines changed

articles/sap/workloads/high-availability-guide-rhel-pacemaker.md

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,8 @@ The following items are prefixed with either **[A]** - applicable to all nodes,
140140
141141
1. If deploying on RHEL 9, install also the resource agents for cloud deployment:
142142

143-
```sudo yum install -y resource-agents-cloud
143+
```
144+
sudo yum install -y resource-agents-cloud
144145
```
145146
146147
1. **[A]** Setup host name resolution
@@ -149,7 +150,7 @@ The following items are prefixed with either **[A]** - applicable to all nodes,
149150
Replace the IP address and the hostname in the following commands.
150151
151152
>[!IMPORTANT]
152-
> If using host names in the cluster configuration, it is vital to have reliable host name resolution. The cluster communication will fail, if the names are not available and that can lead to cluster failover delays.
153+
> If using host names in the cluster configuration, it's vital to have reliable host name resolution. The cluster communication will fail, if the names are not available and that can lead to cluster failover delays.
153154
> The benefit of using /etc/hosts is that your cluster becomes independent of DNS, which could be a single point of failures too.
154155
155156
<pre><code>sudo vi /etc/hosts
@@ -244,7 +245,7 @@ The following items are prefixed with either **[A]** - applicable to all nodes,
244245
The fencing device uses either a managed identity for Azure resource or service principal to authorize against Microsoft Azure.
245246
246247
### Using Managed Identity
247-
To create a managed identity (MSI), [create a system-assigned](../../active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm.md#system-assigned-managed-identity) managed identity for each VM in the cluster. Should a system-assigned managed identity already exist, it will be used. User assigned managed identities should not be used with Pacemaker at this time. Fence device, based on managed identity is supported on RHEL 7.9 and RHEL 8.x/RHEL 9.
248+
To create a managed identity (MSI), [create a system-assigned](../../active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm.md#system-assigned-managed-identity) managed identity for each VM in the cluster. Should a system-assigned managed identity already exist, it will be used. User assigned managed identities should not be used with Pacemaker at this time. Fence device, based on managed identity is supported on RHEL 7.9 and RHEL 8.x/RHEL 9.x.
248249
249250
### Using Service Principal
250251
Follow these steps to create a service principal, if not using managed identity.
@@ -260,11 +261,11 @@ Follow these steps to create a service principal, if not using managed identity.
260261
1. Select Certificates and Secrets, then click New client secret
261262
1. Enter a description for a new key, select "Never expires" and click Add
262263
1. Make a node the Value. It is used as the **password** for the service principal
263-
1. Select Overview. Make a note the Application ID. It is used as the username (**login ID** in the steps below) of the service principal
264+
1. Select Overview. Make a note the Application ID. It's used as the username (**login ID** in the steps below) of the service principal
264265
265266
### **[1]** Create a custom role for the fence agent
266267
267-
Neither managed identity nor service principal has permissions to access your Azure resources by default. You need to give the managed identity or service principal permissions to start and stop (power-off) all virtual machines of the cluster. If you did not already create the custom role, you can create it using [PowerShell](../../role-based-access-control/custom-roles-powershell.md) or [Azure CLI](../../role-based-access-control/custom-roles-cli.md)
268+
Neither managed identity nor service principal has permissions to access your Azure resources by default. You need to give the managed identity or service principal permissions to start and stop (power-off) all virtual machines of the cluster. If you didn't already create the custom role, you can create it using [PowerShell](../../role-based-access-control/custom-roles-powershell.md) or [Azure CLI](../../role-based-access-control/custom-roles-cli.md)
268269
269270
Use the following content for the input file. You need to adapt the content to your subscriptions that is, replace *xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx* and *yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy* with the Ids of your subscription. If you only have one subscription, remove the second entry in AssignableScopes.
270271
@@ -298,7 +299,7 @@ Assign the custom role "Linux Fence Agent Role" that was created in the last cha
298299
299300
#### Using Service Principal
300301

301-
Assign the custom role "Linux Fence Agent Role" that was created in the last chapter to the service principal. Do not use the Owner role anymore! For detailed steps, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.md).
302+
Assign the custom role "Linux Fence Agent Role" that was created in the last chapter to the service principal. Don't use the Owner role anymore! For detailed steps, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.md).
302303
Make sure to assign the role for both cluster nodes.
303304

304305
### **[1]** Create the fencing devices
@@ -350,7 +351,7 @@ op monitor interval=3600
350351

351352
---
352353

353-
If you are using fencing device, based on service principal configuration, read [Change from SPN to MSI for Pacemaker clusters using Azure fencing](https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-high-availability-change-from-spn-to-msi-for/ba-p/3609278) and learn how to convert to managed identity configuration.
354+
If you're using fencing device, based on service principal configuration, read [Change from SPN to MSI for Pacemaker clusters using Azure fencing](https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-high-availability-change-from-spn-to-msi-for/ba-p/3609278) and learn how to convert to managed identity configuration.
354355

355356
> [!TIP]
356357
> Only configure the `pcmk_delay_max` attribute in two node Pacemaker clusters. For more information on preventing fence races in a two node Pacemaker cluster, see [Delaying fencing in a two node cluster to prevent fence races of "fence death" scenarios](https://access.redhat.com/solutions/54829).

0 commit comments

Comments
 (0)