[controller] Disable quorum and auto-TieBreaker for single-replica StorageClasses#637
Draft
IvanOgurchenok wants to merge 1 commit into
Draft
[controller] Disable quorum and auto-TieBreaker for single-replica StorageClasses#637IvanOgurchenok wants to merge 1 commit into
IvanOgurchenok wants to merge 1 commit into
Conversation
…orageClasses For ReplicationNone (placementCount=1) quorum is meaningless because there is only one data copy and split-brain is impossible. Previously auto-quorum=suspend-io and auto-add-quorum-tiebreaker=true were set for all replication modes, causing LINSTOR to create a diskless TieBreaker and enable quorum=majority even for r1 resources. When the diskless peer lost connectivity, DRBD blocked I/O with SS_NO_QUORUM (-25) despite the single diskful replica being perfectly healthy. Move quorum-related SC parameters (auto-quorum, auto-add-quorum-tiebreaker, on-no-quorum) from the common block into per-replication-mode cases and set auto-add-quorum-tiebreaker=false for ReplicationNone. Signed-off-by: Ivan Ogurchenok <ivan.ogurchenok@flant.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Disable DRBD quorum and auto-TieBreaker for single-replica (
ReplicationNone) StorageClasses.Move quorum-related SC parameters (
auto-quorum,auto-add-quorum-tiebreaker,on-no-quorum) from the common parameter block into per-replication-mode switch cases. ForReplicationNonesetauto-add-quorum-tiebreaker=falseand do not setauto-quorumoron-no-quorum. No changes forReplicationAvailability(r2) andReplicationConsistencyAndAvailability(r3).Why do we need it, and what problem does it solve?
For
ReplicationNone(placementCount=1) the controller setsauto-quorum=suspend-ioandauto-add-quorum-tiebreaker=true— same as for r2/r3. This causes LINSTOR to create a diskless TieBreaker and enablequorum=majorityon single-replica resources. When a diskless peer (TieBreaker or CSI remote-access replica) loses connectivity, DRBD cannot achieve majority (1 of 2) and blocks all I/O withSS_NO_QUORUM(state change failed -25in dmesg), even though the single diskful replica is healthy and data is intact.This effectively turns a harmless network blip into a complete volume outage for r1 workloads.
What is the expected result?
ReplicationNoneStorageClasses MUST NOT containauto-quorumandon-no-quorumparameters and MUST haveauto-add-quorum-tiebreaker=false.quorum=majorityset by LINSTOR.SS_NO_QUORUMerrors.ReplicationAvailability(r2) andReplicationConsistencyAndAvailability(r3) StorageClasses MUST NOT be affected — their quorum parameters remain unchanged.quorum=majorityare not fixed by this change and require a manual fix or a separate watcher patch:Checklist