You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sap/workloads/high-availability-guide-rhel-pacemaker.md
+8-7Lines changed: 8 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -140,7 +140,8 @@ The following items are prefixed with either **[A]** - applicable to all nodes,
140
140
141
141
1. If deploying on RHEL 9, install also the resource agents for cloud deployment:
142
142
143
-
```sudo yum install -y resource-agents-cloud
143
+
```
144
+
sudo yum install -y resource-agents-cloud
144
145
```
145
146
146
147
1. **[A]** Setup host name resolution
@@ -149,7 +150,7 @@ The following items are prefixed with either **[A]** - applicable to all nodes,
149
150
Replace the IP address and the hostname in the following commands.
150
151
151
152
>[!IMPORTANT]
152
-
> If using host names in the cluster configuration, it is vital to have reliable host name resolution. The cluster communication will fail, if the names are not available and that can lead to cluster failover delays.
153
+
> If using host names in the cluster configuration, it's vital to have reliable host name resolution. The cluster communication will fail, if the names are not available and that can lead to cluster failover delays.
153
154
> The benefit of using /etc/hosts is that your cluster becomes independent of DNS, which could be a single point of failures too.
154
155
155
156
<pre><code>sudo vi /etc/hosts
@@ -244,7 +245,7 @@ The following items are prefixed with either **[A]** - applicable to all nodes,
244
245
The fencing device uses either a managed identity for Azure resource or service principal to authorize against Microsoft Azure.
245
246
246
247
### Using Managed Identity
247
-
To create a managed identity (MSI), [create a system-assigned](../../active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm.md#system-assigned-managed-identity) managed identity for each VM in the cluster. Should a system-assigned managed identity already exist, it will be used. User assigned managed identities should not be used with Pacemaker at this time. Fence device, based on managed identity is supported on RHEL 7.9 and RHEL 8.x/RHEL 9.
248
+
To create a managed identity (MSI), [create a system-assigned](../../active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm.md#system-assigned-managed-identity) managed identity for each VM in the cluster. Should a system-assigned managed identity already exist, it will be used. User assigned managed identities should not be used with Pacemaker at this time. Fence device, based on managed identity is supported on RHEL 7.9 and RHEL 8.x/RHEL 9.x.
248
249
249
250
### Using Service Principal
250
251
Follow these steps to create a service principal, if not using managed identity.
@@ -260,11 +261,11 @@ Follow these steps to create a service principal, if not using managed identity.
260
261
1. Select Certificates and Secrets, then click New client secret
261
262
1. Enter a description for a new key, select "Never expires" and click Add
262
263
1. Make a node the Value. It is used as the **password** for the service principal
263
-
1. Select Overview. Make a note the Application ID. It is used as the username (**login ID** in the steps below) of the service principal
264
+
1. Select Overview. Make a note the Application ID. It's used as the username (**login ID** in the steps below) of the service principal
264
265
265
266
### **[1]** Create a custom role for the fence agent
266
267
267
-
Neither managed identity nor service principal has permissions to access your Azure resources by default. You need to give the managed identity or service principal permissions to start and stop (power-off) all virtual machines of the cluster. If you did not already create the custom role, you can create it using [PowerShell](../../role-based-access-control/custom-roles-powershell.md) or [Azure CLI](../../role-based-access-control/custom-roles-cli.md)
268
+
Neither managed identity nor service principal has permissions to access your Azure resources by default. You need to give the managed identity or service principal permissions to start and stop (power-off) all virtual machines of the cluster. If you didn't already create the custom role, you can create it using [PowerShell](../../role-based-access-control/custom-roles-powershell.md) or [Azure CLI](../../role-based-access-control/custom-roles-cli.md)
268
269
269
270
Use the following content for the input file. You need to adapt the content to your subscriptions that is, replace *xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx* and *yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy* with the Ids of your subscription. If you only have one subscription, remove the second entry in AssignableScopes.
270
271
@@ -298,7 +299,7 @@ Assign the custom role "Linux Fence Agent Role" that was created in the last cha
298
299
299
300
#### Using Service Principal
300
301
301
-
Assign the custom role "Linux Fence Agent Role" that was created in the last chapter to the service principal. Do not use the Owner role anymore! For detailed steps, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.md).
302
+
Assign the custom role "Linux Fence Agent Role" that was created in the last chapter to the service principal. Don't use the Owner role anymore! For detailed steps, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.md).
302
303
Make sure to assign the role for both cluster nodes.
303
304
304
305
### **[1]** Create the fencing devices
@@ -350,7 +351,7 @@ op monitor interval=3600
350
351
351
352
---
352
353
353
-
If you are using fencing device, based on service principal configuration, read [Change from SPN to MSI for Pacemaker clusters using Azure fencing](https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-high-availability-change-from-spn-to-msi-for/ba-p/3609278) and learn how to convert to managed identity configuration.
354
+
If you're using fencing device, based on service principal configuration, read [Change from SPN to MSI for Pacemaker clusters using Azure fencing](https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-high-availability-change-from-spn-to-msi-for/ba-p/3609278) and learn how to convert to managed identity configuration.
354
355
355
356
> [!TIP]
356
357
> Only configure the `pcmk_delay_max` attribute in two node Pacemaker clusters. For more information on preventing fence races in a two node Pacemaker cluster, see [Delaying fencing in a two node cluster to prevent fence races of "fence death" scenarios](https://access.redhat.com/solutions/54829).
0 commit comments