Mailing List Archive: slapd ocf resource agent

slapd ocf resource agent

Sep 23, 2011, 12:46 PM

Post #1 of 6 (3108 views)

Many thanks to Jeroen and Tomo for starting this. I have taken their
versions, incorporated the recommendations from Dejan's review, made a
few improvements of my own, and committed to a fork on GitHub:

https://github.com/jhohm/resource-agents

I'm not sure of your workflow, can I just make a GitHub pull request?

I am using this version in production, with the data and cn=config on
LVM on DRBD on RHEL 6.1. The relevant portions of my pacemaker
configuration:

primitive ldap-a-drbd ocf:linbit:drbd \
params drbd_resource="ldap-a" \
op monitor interval="15s" \
op start interval="0" timeout="240s" \
op stop interval="0" timeout="100s"

primitive ldap-a-fs-data ocf:heartbeat:Filesystem \
params device="/dev/dvg_ldapa/dlv_data" \
directory="/srv/ldap/a/data" fstype="ext4" \
options="data=writeback,barrier=0" \
op start interval="0" timeout="60s" \
op stop interval="0" timeout="60s"

primitive ldap-a-fs-log ocf:heartbeat:Filesystem \
params device="/dev/dvg_ldapa/dlv_log" \
directory="/srv/ldap/a/log" fstype="ext4" \
options="data=writeback,barrier=0" \
op start interval="0" timeout="60s" \
op stop interval="0" timeout="60s"

primitive ldap-a-ip ocf:heartbeat:IPaddr2 \
params ip="10.1.2.3" cidr_netmask="25" nic="vlan13" \
op monitor interval="5s"

primitive ldap-a-lvm ocf:heartbeat:LVM \
params volgrpname="dvg_ldapa" exclusive="true" \
op monitor interval="10s" timeout="30s" \
op start interval="0" timeout="30s" \
op stop interval="0" timeout="30s"

primitive ldap-a-slapd ocf:heartbeat:slapd \
params config="/srv/ldap/a/data/slapd.d" \
pidfile="/var/run/ldap-a/slapd.pid" \
services="ldap://ldap-a.example.com/" \
user="ldap" group="ldap" \
op monitor interval="60s" timeout="20s" \
op start interval="0" timeout="20s" \
op stop interval="0" timeout="20s"

primitive ldap-a-snmpd ocf:heartbeat:anything \
params binfile="/usr/local/sbin/mini_snmpd" \
cmdline_options="-c secret -I 10.1.2.3 \
-d /srv/ldap/a/data,/srv/ldap/a/log" \
logfile="/var/log/ldap-a/snmpd.log" \
errlogfile="/var/log/ldap-a/snmpd.err"

group ldap-a ldap-a-lvm ldap-a-fs-data ldap-a-fs-log ldap-a-ip \
ldap-a-slapd ldap-a-snmpd

ms ldap-a-ms-drbd ldap-a-drbd \
meta master-max="1" master-node-max="1" \
clone-max="2" clone-node-max="1" notify="true"

colocation ldap-a-on-drbd inf: ldap-a ldap-a-ms-drbd:Master

order ldap-a-after-drbd inf: ldap-a-ms-drbd:promote ldap-a:start

--
John Keith Hohm
<john@hohm.net>
_______________________________________________________
Linux-HA-Dev: Linux-HA-Dev@lists.linux-ha.org
http://lists.linux-ha.org/mailman/listinfo/linux-ha-dev
Home Page: http://linux-ha.org/

Re: slapd ocf resource agent [ In reply to ]

dejan at suse

Sep 26, 2011, 9:25 AM

Post #2 of 6 (3038 views)

Permalink

Hi John,

On Fri, Sep 23, 2011 at 02:46:05PM -0500, John Keith Hohm wrote:
> Many thanks to Jeroen and Tomo for starting this. I have taken their
> versions, incorporated the recommendations from Dejan's review, made a
> few improvements of my own, and committed to a fork on GitHub:
>
> https://github.com/jhohm/resource-agents
>
> I'm not sure of your workflow, can I just make a GitHub pull request?

There's no one specific workflow, but in case of new agents, I'd
rather just add a file myself. That is unless for some reason
you want to keep the history.

It's been a while since I looked at the RA, I'll take another
look tomorrow.

> I am using this version in production, with the data and cn=config on
> LVM on DRBD on RHEL 6.1.

So, you use DRBD to replicate the data. Did you consider using
the slapd mirror mode? Would that also work with this RA?

Many thanks for contributing!

Cheers,

Dejan

> The relevant portions of my pacemaker
> configuration:
>
> primitive ldap-a-drbd ocf:linbit:drbd \
> params drbd_resource="ldap-a" \
> op monitor interval="15s" \
> op start interval="0" timeout="240s" \
> op stop interval="0" timeout="100s"
>
> primitive ldap-a-fs-data ocf:heartbeat:Filesystem \
> params device="/dev/dvg_ldapa/dlv_data" \
> directory="/srv/ldap/a/data" fstype="ext4" \
> options="data=writeback,barrier=0" \
> op start interval="0" timeout="60s" \
> op stop interval="0" timeout="60s"
>
> primitive ldap-a-fs-log ocf:heartbeat:Filesystem \
> params device="/dev/dvg_ldapa/dlv_log" \
> directory="/srv/ldap/a/log" fstype="ext4" \
> options="data=writeback,barrier=0" \
> op start interval="0" timeout="60s" \
> op stop interval="0" timeout="60s"
>
> primitive ldap-a-ip ocf:heartbeat:IPaddr2 \
> params ip="10.1.2.3" cidr_netmask="25" nic="vlan13" \
> op monitor interval="5s"
>
> primitive ldap-a-lvm ocf:heartbeat:LVM \
> params volgrpname="dvg_ldapa" exclusive="true" \
> op monitor interval="10s" timeout="30s" \
> op start interval="0" timeout="30s" \
> op stop interval="0" timeout="30s"
>
> primitive ldap-a-slapd ocf:heartbeat:slapd \
> params config="/srv/ldap/a/data/slapd.d" \
> pidfile="/var/run/ldap-a/slapd.pid" \
> services="ldap://ldap-a.example.com/" \
> user="ldap" group="ldap" \
> op monitor interval="60s" timeout="20s" \
> op start interval="0" timeout="20s" \
> op stop interval="0" timeout="20s"
>
> primitive ldap-a-snmpd ocf:heartbeat:anything \
> params binfile="/usr/local/sbin/mini_snmpd" \
> cmdline_options="-c secret -I 10.1.2.3 \
> -d /srv/ldap/a/data,/srv/ldap/a/log" \
> logfile="/var/log/ldap-a/snmpd.log" \
> errlogfile="/var/log/ldap-a/snmpd.err"
>
> group ldap-a ldap-a-lvm ldap-a-fs-data ldap-a-fs-log ldap-a-ip \
> ldap-a-slapd ldap-a-snmpd
>
> ms ldap-a-ms-drbd ldap-a-drbd \
> meta master-max="1" master-node-max="1" \
> clone-max="2" clone-node-max="1" notify="true"
>
> colocation ldap-a-on-drbd inf: ldap-a ldap-a-ms-drbd:Master
>
> order ldap-a-after-drbd inf: ldap-a-ms-drbd:promote ldap-a:start
>
> --
> John Keith Hohm
> <john@hohm.net>
> _______________________________________________________
> Linux-HA-Dev: Linux-HA-Dev@lists.linux-ha.org
> http://lists.linux-ha.org/mailman/listinfo/linux-ha-dev
> Home Page: http://linux-ha.org/
_______________________________________________________
Linux-HA-Dev: Linux-HA-Dev@lists.linux-ha.org
http://lists.linux-ha.org/mailman/listinfo/linux-ha-dev
Home Page: http://linux-ha.org/

slapd ocf resource agent [ In reply to ]

john at hohm

Sep 28, 2011, 1:38 PM

Post #3 of 6 (3029 views)

Permalink

> There's no one specific workflow, but in case of new agents, I'd
> rather just add a file myself. That is unless for some reason
> you want to keep the history.

That is fine with me, I can only guess that Jeroen and Tomo are fine
with the attribution of authoring unspecified portions. I think there
are no great secrets behind why the agent does what it does that would
require the history to understand.

> So, you use DRBD to replicate the data. Did you consider using
> the slapd mirror mode? Would that also work with this RA?

I think mirror mode solves a different problem than clustering. We are
also using N-Way Multi-Master replication, not between cluster nodes but
between the clustered slapd and other, virtual, servers. Meanwhile, the
clustered slapd gets the highest priority among the multiple LDAP server
addresses configured for the domain, and I don't have to worry about
delaying lookups when I take a node down.

I suppose if one were afraid of multi-master mode and wanted to manage a
slapd syncrepl group where the master moved between nodes, it would make
sense to enhance this resource agent to support it.

--
John Keith Hohm
<john@hohm.net>
_______________________________________________________
Linux-HA-Dev: Linux-HA-Dev@lists.linux-ha.org
http://lists.linux-ha.org/mailman/listinfo/linux-ha-dev
Home Page: http://linux-ha.org/

Re: slapd ocf resource agent [ In reply to ]

dejan at suse

Sep 29, 2011, 7:21 AM

Post #4 of 6 (3048 views)

Permalink

On Wed, Sep 28, 2011 at 03:38:15PM -0500, John Keith Hohm wrote:
> > There's no one specific workflow, but in case of new agents, I'd
> > rather just add a file myself. That is unless for some reason
> > you want to keep the history.
>
> That is fine with me, I can only guess that Jeroen and Tomo are fine
> with the attribution of authoring unspecified portions. I think there
> are no great secrets behind why the agent does what it does that would
> require the history to understand.

The RA has been applied and pushed to the common repository. I
just reduced the default for stop_escalate to 15 seconds to
match the advised stop timeout of 20 seconds.

It would've been better if the agent was added to the OpenLDAP
distribution, as it has been suggested in the beginning, but it
seems like that policy is to remain in the realm of wishful
thinking.

A few notes:

- the RA cannot support configuration on shared storage, for
that probes would need to be handled better (right now, it
would just exit with OCF_ERR_INSTALLED)
- the terminate function is sort of hard to understand
- code could be still improved here and there (though it seems
correct to me)

> > So, you use DRBD to replicate the data. Did you consider using
> > the slapd mirror mode? Would that also work with this RA?
>
> I think mirror mode solves a different problem than clustering. We are
> also using N-Way Multi-Master replication, not between cluster nodes but
> between the clustered slapd and other, virtual, servers. Meanwhile, the
> clustered slapd gets the highest priority among the multiple LDAP server
> addresses configured for the domain, and I don't have to worry about
> delaying lookups when I take a node down.
>
> I suppose if one were afraid of multi-master mode and wanted to manage a
> slapd syncrepl group where the master moved between nodes, it would make
> sense to enhance this resource agent to support it.

OK. My experience with OpenLDAP is already rusty. Though I
understand that this RA, as it is, could still be used with the
mirror mode.

In your previous message you have also shown an example
cluster configuration. A number of RA are documented in more
detail at wiki.linux-ha.org and you may want to add a slapd
section.

Also, there's a RA test utility called ocft, it would be great
to get an ocft test file for the slapd RA.

Cheers,

Dejan

> --
> John Keith Hohm
> <john@hohm.net>
> _______________________________________________________
> Linux-HA-Dev: Linux-HA-Dev@lists.linux-ha.org
> http://lists.linux-ha.org/mailman/listinfo/linux-ha-dev
> Home Page: http://linux-ha.org/
_______________________________________________________
Linux-HA-Dev: Linux-HA-Dev@lists.linux-ha.org
http://lists.linux-ha.org/mailman/listinfo/linux-ha-dev
Home Page: http://linux-ha.org/

slapd ocf resource agent [ In reply to ]

john at hohm

Oct 10, 2011, 10:41 AM

Post #5 of 6 (2999 views)

Permalink

> The RA has been applied and pushed to the common repository. I
> just reduced the default for stop_escalate to 15 seconds to
> match the advised stop timeout of 20 seconds.

Thanks, Dejan!

> - the RA cannot support configuration on shared storage, for
> that probes would need to be handled better (right now, it
> would just exit with OCF_ERR_INSTALLED)

It does in fact support configuration on shared storage, but only if
OCF_RESKEY_pidfile is specified; without that parameter being set you
are correct, the RA must fail as it then cannot locate the PID file.

> In your previous message you have also shown an example
> cluster configuration. A number of RA are documented in more
> detail at wiki.linux-ha.org and you may want to add a slapd
> section.

I see a pattern of links in the docs, I guess that page goes here:

http://www.linux-ha.org/wiki/Slapd_%28resource_agent%29

> Also, there's a RA test utility called ocft, it would be great
> to get an ocft test file for the slapd RA.

Ah, I did not notice that before, but it looks nice. I will try to make
a good ocft/slapd, though I admit it is not clear to me what
InstallPackage should say since slapd is, depending on the distro, in a
package named:

* openldap2 (SUSE, I think)

* openldap-servers (RHEL/SL/CentOS, which I am using)

* slapd (Debian/Ubuntu)

--
John Keith Hohm
<john@hohm.net>
_______________________________________________________
Linux-HA-Dev: Linux-HA-Dev@lists.linux-ha.org
http://lists.linux-ha.org/mailman/listinfo/linux-ha-dev
Home Page: http://linux-ha.org/

Re: slapd ocf resource agent [ In reply to ]

dejan at suse

Oct 11, 2011, 8:35 AM

Post #6 of 6 (3003 views)

Permalink

On Mon, Oct 10, 2011 at 12:41:45PM -0500, John Keith Hohm wrote:
> > The RA has been applied and pushed to the common repository. I
> > just reduced the default for stop_escalate to 15 seconds to
> > match the advised stop timeout of 20 seconds.
>
> Thanks, Dejan!
>
> > - the RA cannot support configuration on shared storage, for
> > that probes would need to be handled better (right now, it
> > would just exit with OCF_ERR_INSTALLED)
>
> It does in fact support configuration on shared storage, but only if
> OCF_RESKEY_pidfile is specified; without that parameter being set you
> are correct, the RA must fail as it then cannot locate the PID file.

OK. But by default it wouldn't work. At any rate, it shouldn't
be difficult to update it to take care of the shared storage
details too.

> > In your previous message you have also shown an example
> > cluster configuration. A number of RA are documented in more
> > detail at wiki.linux-ha.org and you may want to add a slapd
> > section.
>
> I see a pattern of links in the docs, I guess that page goes here:
>
> http://www.linux-ha.org/wiki/Slapd_%28resource_agent%29

Right.

> > Also, there's a RA test utility called ocft, it would be great
> > to get an ocft test file for the slapd RA.
>
> Ah, I did not notice that before, but it looks nice. I will try to make
> a good ocft/slapd, though I admit it is not clear to me what
> InstallPackage should say since slapd is, depending on the distro, in a
> package named:
>
> * openldap2 (SUSE, I think)
>
> * openldap-servers (RHEL/SL/CentOS, which I am using)
>
> * slapd (Debian/Ubuntu)

Well, use whichever you have. We don't have a preference.
Unfortunately, there's no well defined mechanism, or at least I
am not aware of it, to get a package depending on the
functionality it should provide. So, if somebody wants to run
ocft on another distribution they'll have to install the package
by hand.

Cheers,

Dejan

> --
> John Keith Hohm
> <john@hohm.net>
> _______________________________________________________
> Linux-HA-Dev: Linux-HA-Dev@lists.linux-ha.org
> http://lists.linux-ha.org/mailman/listinfo/linux-ha-dev
> Home Page: http://linux-ha.org/
_______________________________________________________
Linux-HA-Dev: Linux-HA-Dev@lists.linux-ha.org
http://lists.linux-ha.org/mailman/listinfo/linux-ha-dev
Home Page: http://linux-ha.org/