1

I'm trying to configure pacemaker cluster with two hosts, I'm using two centos 7(CentOS Linux release 7.2.1511 (Core)) virtual machines.

What I did so far: I installed packages:

yum install pacemaker corosync haproxy pcs fence-agents-all

Set password for user hacluster on both servers. Edit /etc/hosts on both machines

10.0.0.14 vm_haproxy1
10.0.0.15 vm_haproxy2

After that enabled services on both servers

systemctl enable pcsd.service pacemaker.service corosync.service haproxy.service

And started pcsd (on both servers)

systemctl start pcsd.service

Service is running on both, I can telnet from one to another on port 2224 

telnet vm_haproxy1 2224
Trying 10.0.0.14...
Connected to vm_haproxy1.
Escape character is '^]'.

Output from the netstat:

[root@vm_haproxy2 ~]# netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      849/sshd            
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      946/master          
tcp6       0      0 :::2224                 :::*                    LISTEN      1949/ruby           
tcp6       0      0 :::22                   :::*                    LISTEN      849/sshd            
tcp6       0      0 ::1:25                  :::*                    LISTEN      946/master          
udp        0      0 127.0.0.1:323           0.0.0.0:*                           619/chronyd         
udp6       0      0 ::1:323                 :::*                                619/chronyd

Pcsd is binding to ipv6 but like I already said telnet works Selinux and firewalld are disabled.

Then I tried to authorise hosts with

pcs cluster auth vm_haproxy1 vm_haproxy2

but I got an error:

 
pcs cluster auth vm_haproxy1 vm_haproxy2
Username: hacluster
Password: 
Error: Unable to communicate with vm_haproxy1
Error: Unable to communicate with vm_haproxy2

I didn't find any help on google. Maybe there is some one who had already solved that problem with pcs authorisation.

Improve this question

10 Answers 10

Reset to default
2

I typically don't use pcsd in my clusters, but the times that I have, I recall setting up the authentication after I had a working cluster; function first, frill later.

I would try using the following commands from both nodes to create the corosync configuration and start the cluster, before setting up your authentication: 

# pcs cluster setup --local --name haproxy-cluster0 vm_haproxy1 vm_haproxy2
# systemctl start corosync
# systemctl start pacemaker

Once you see your nodes online in the output of crm_mon, try your steps for setting up the node authentication.

Improve this answer
1

I had this issue. In my case I tracked it down to the environment variables for proxies being set.

To check this: first run the command with --debug enabled:

pcs --debug cluster auth clua club cluc

In the debug output I could see:

Sending HTTP Request to: https://club:2224/remote/check_auth
Data: None
Response Reason: Tunnel connection failed: 404 Not Found
...
"I, [2017-04-05T10:54:21.333320 #6755]  INFO -- : No response from: cluc request: /auth, exception: 404 \"Not Found\"\n",
"I, [2017-04-05T10:54:21.334344 #6755]  INFO -- : No response from: club request: /auth, exception: 404 \"Not Found\"\n",
"I, [2017-04-05T10:54:21.334852 #6755]  INFO -- : No response from: clua request: /auth, exception: 404 \"Not Found\"\n"

Running curl towards the URL it was trying to use gave more explicit information:

# curl https://club:2224/remote/check_auth
curl: (56) Received HTTP code 404 from proxy after CONNECT

Unsetting http_proxy and https_proxy enabled it to work.

If you don't have too many nodes, you can list them in the no_proxy environment variable. Otherwise it's a bit painful - you need to ensure you always run the pcs commands with no proxy environment variables set. I have so far not found any way to configured pcs not to use these variables.

You could write a little wrapper that unsets the variables and then calls pcs.

Improve this answer
1

If you are using CentOS 7, check:

systemctl start pcsd.service 
systemctl enable pcsd.service

The start will run it now. If that produces any error messages those should be addressed. The enable cause it to start automatically on the next boot.

Improve this answer
1

If not answered , i face similar issues, i missed the firewall enable setting, after executing below commands, issue was solved for me

firewall-cmd --permanent --add-service=high-availability

firewall-cmd --add-service=high-availability

firewall-cmd –reload

Improve this answer
1

For my case, i just opened port in firewall using:

firewall-cmd --add-port=2224/tcp --permanent && firewall-cmd --reload

then everything will be ok

Improve this answer
0

I was getting this earlier:

[root@vm01 .ssh]# pcs cluster auth vm01 vm02 -u hacluster -p redhat
Error: Unable to communicate with vm02
vm01: Authorized

After flushing the iptables on both nodes, it worked.

[root@vm01 .ssh]# pcs cluster auth vm01 vm02 -u hacluster -p redhat
vm02: Authorized
vm01: Authorized
Improve this answer
1
  • That means your iptables prevented communication. The OP says telnet between the nodes works.
    – RalfFriedl
    Sep 22, 2018 at 18:21
0

Unable to communicate with pcmk-2

Make sure that pcsd.service service is running if its not running then need to check getenforce is set to Permissive , if its not set to permissive then pcsd service will not run and it will not able to communicate

Note : systemctl status pcsd.service ( command to check pcsd status )

Improve this answer
1
  • It would be better to detail how to make PCSD run under SELinux, since it's normally just a case of managing the contexts?
    – shearn89
    Jan 7, 2022 at 9:12
-1

I was facing the same issue and when tried creating the cluster locally to have the cluster.conf file created but it doesnt seems to work.

  1. yum install pacemaker corosync haproxy pcs fence-agents-all

  2. systemctl disable firewalld ; systemctl stop firewalld systemctl enable pcsd.service pacemaker.service corosync.service haproxy.service

  3. pcs cluster setup --local --name resource Openstackvm2.server.com OpenstackVm3.server.com --force

Shutting down pacemaker/corosync services...

Redirecting to /bin/systemctl stop pacemaker.service Redirecting to /bin/systemctl stop corosync.service Killing any remaining services... Removing all cluster configuration files.

  1. pcs cluster auth Openstackvm2.server.com OpenstackVm3.server.com

Username: hacluster

Password:

Error: Unable to communicate with Openstackvm2.server.com

Error: Unable to communicate with OpenstackVm3.server.com

It looks like there is a Bug posted int he Redhat site but I do not have the privileges to see the full thread.

https://access.redhat.com/solutions/1413723

Improve this answer
-1

Check /etc/hosts file entries.

cat /etc/hosts

IP Addr of host1 Hostname1 IP Addr of host2 Hostname2

It must in the above manner. Flush IP Tables on both the nodes us nodes:

iptable -F

Improve this answer
1
  • 1
    Your iptables command is wrong, and you clearly didn't read the information in the question. And you formatted your whole answer wrong.
    – Andrew Schulman
    Apr 7, 2018 at 17:54
-2

I stop firewalld.service use the following command, and then pcs cluster auth is worked for me.

systemctl stop firewalld.service
Improve this answer
1
  • Telling people to turn off their firewalls on their servers without telling them the consequences would be irresponsible, I think.
    – mforsetti
    Mar 3, 2021 at 4:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .