Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Driver cluster

Supported keywords:

  • ca
  • cert
  • comment
  • dns
  • dns_reverse
  • drpnodes
  • envs
  • id
  • name
  • nodes
  • quorum
  • secret

Keyword ca

required:    false
scopable:    false
convert:     list
rbac:        This driver group requires the root grant.

Default:

system/sec/ca

Description:

A whitespace-separated list of sec paths.

The listener accepts a x509 client certificate if it is trusted by any CA certificate found in these sec objects.

Keyword cert

required:    false
scopable:    false
rbac:        This driver group requires the root grant.

Default:

system/sec/cert

Description:

The path of the secret hosting the certificate that the listener use for its TLS socket.

Keyword comment

required:    false
scopable:    false
rbac:        This driver group requires the root grant.

Description:

A free form text describing the role of the object, of the node, or of the section it is set in.

The keyword is accepted in any section, so the DEFAULT section can document a configuration as a whole, and a resource, pool, heartbeat, array or network section can document itself.

The agent does not interpret the value.

Keyword dns

required:    false
scopable:    true
convert:     list
rbac:        This driver group requires the root grant.

Description:

The list of nodes to set as nameserver in the resolv.conf of the containers the CRM starts.

If set, the search will also be set to:

1/ <name>.<namespace>.svc.<clustername> 2/ <namespace>.svc.<clustername> 3/ <clustername>.

Keyword dns_reverse

required:    false
scopable:    false
default:     true
convert:     bool
rbac:        This driver group requires the root grant.

Description:

The cluster nameservers answer the reverse lookups of the addresses of the cluster networks, with the name of the object holding each, from the reverse zones of the addresses om hands out: the ones of the ranges of a lan network, the ones of the whole network for the others.

A client allowed to query the cluster nameservers, as a container of any namespace, can then list the names of the objects holding the addresses of a range, those of the other namespaces included, by looking each address up. Set to false on a cluster where these names are not to be listed: the reverse lookups of its addresses are then not answered.

Keyword drpnodes

required:    false
scopable:    false
convert:     list
rbac:        This driver group requires the root grant.

Description:

This list is fetched from the join command payload received from the joined node.

The service configuration {clusterdrpnodes} is resolved to this keyword value.

Keyword envs

required:    false
scopable:    false
default:     CERT DEV DRP FOR INT PRA PRD PRJ PPRD QUAL REC STG TMP TST UAT
convert:     list
rbac:        This driver group requires the root grant.

Description:

The list of environment codes the cluster uses, offered as the choice for the env keyword of the node and of the objects.

The agent does not restrict env to this list. It is a site convention, which the user interfaces read from the cluster configuration.

Keyword id

required:    false
scopable:    true
rbac:        This driver group requires the root grant.

Default:

An autogenerated random UUID.

Description:

This unique identifier is auto-generated on install and should never be change by the cluster administrators.

It is changed when the node joins a cluster, so the remote cluster id replaces the joiners’ cluster id.

Keyword name

required:    false
scopable:    false
rbac:        This driver group requires the root grant.

Default:

A random generated clustername. Description:

The cluster name is used,

  • as the zone name in the cluster dns records
  • in the {fqdn} configuration reference
  • in the AES secret encryption metadata

The cluster name should be unique site-wide. Missing cluster name will be automatically created with random value during daemon startup.

It is always lowercased, so better to set it to a lowercase value to avoid confusion.

The cluster name is provided to joining nodes, so they can replace their own.

Keyword nodes

required:    false
scopable:    false
convert:     list
rbac:        This driver group requires the root grant.

Description:

This list of node names contains only the local node name on install.

When the node joins a cluster, the joined node provides the new list, with the new node added. The joiner then replace its nodes list with the one received.

When a node receives a join request, it adds the new node to its cluster nodes list, then provide the new list to the joiner.

Keyword quorum

required:    false
scopable:    false
default:     false
convert:     bool
rbac:        This driver group requires the root grant.

Description:

If true, when the cluster is split a vote happens on each cluster node.

Each reachable node and each reachable arbitrator give their vote. If the votes is less than half the total number of nodes plus arbitrators, the node trigger a node fencing method defined by node.split_action (crash, reboot or disabled).

Keyword secret

required:    false
scopable:    true
secret:      true
rbac:        This driver group requires the root grant.

Default:

A random string autogenerated on first use

Description:

The cluster shared secret used to encrypt and decrypt heartbeat payloads and sec values, with AES256

This secret is auto-generated on install, then merged from the joined nodes when joining a cluster.

The cluster secret should be unique site-wide, and be set before starting to add sec keys: changing it later leaves the values encrypted with the previous one unreadable.