Simple Clustering on CentOS 7/RHEL 7 for an haproxy Load Balancer

Here are the steps to get a simple cluster going. We're not going to share storage, so the quorom isn't going to work. We'll disable stonith and quorom. 

pre-req: add hosts file entries for all nodes on all nodes, or at least make sure DNS is working correctly. You might receive errors like:

Error: unable to get crm_config, is pacemaker running?

yum install pcs fence-agents-all -y
firewall-cmd --permanent --add-service=high-availability
# set the password for the hacluster user - it should probably be the same on all nodes
passwd hacluster
# disable haproxy, as the cluster will start it

systemctl disable haproxy

# enable the services
systemctl enable pcsd
systemctl enable corosync
systemctl enable pacemaker
systemctl start pcsd.service

### we're not going to have a stonith nor a quorom
pcs property set stonith-enabled=false
pcs property set no-quorum-policy=ignore

# check to see if it's alive
systemctl is-active pcsd.service
pcs cluster auth `hostname`
pcs cluster setup --start --name myclustername `hostname`
pcs cluster status
# add an IP as a resource
pcs resource create vip1 IPaddr2 ip=172.29.23.80 cidr_netmask=22 --group haproxy

to add an additional node called "mynode2"
authorize it on the master:

 pcs cluster auth mynode2

(authenticate using "hacluster" user)

add it:

pcs cluster node add mynode2


You'll need to start the other node:

pcs cluster start mynode2

To see the status of the nodes:


pc status nodes

example:
pcs status nodes
Pacemaker Nodes:
 Online: mynode1
 Standby:
 Offline: mynode2

Now we add haproxy. Since the haproxy service wouldn't be too useful without the IP address, we'll set up a colocation rule as well.

pcs resource create HAproxy --group haproxy  systemd:haproxy op monitor interval=10s
pcs constraint colocation add HAproxy vip1
pcs constraint order vip1 then HAproxy

# optional - we want the cluster to "favor" mynode1.
# if mynode1 is restarted, for example, mynode2 will get the resources, 
# until mynode1 is back and running
pcs constraint location vip11 prefers mynode1 

We'll want to turn off haproxy in systemd as the cluster will start it:

systemctl disable haproxy 

CentOS 7 error: Connection 'wired connection 1' is not available on the device ens32 at this time.

This error is presented when attempting to bring up a network connection using nmcli. The connection name can be anything, of course.

There is a RedHat bug on this titled "RHEL 7 syslog shows failure related to network.service" bug #1079353.

There is no fix listed in the bug. I've seen this on a virtual machine, and the easiest work around was to delete the virtual machine's NIC, reboot, add a new NIC - reboot. After doing that, I deleted the new network connection using nmcli and applied the new device to the original connection profile I was attempting to use.

RHEL/CentOS nmcli Tips

You may need to disable selinux temporarily to make changes to these files (setenforce 0)

(note that many nmcli commands will fail if the underlying device is not active (i.e., disconnected in VMware))

1. List connections

nmcli c show

2. rename an connection id called "outside" - change it to eth0

nmcli c modify outside connection.id eth0

3. change a nic (with a connection name of "ethernet" and a device name of ens32) to static and assign an address, gw, dns, etc. (172.19.22.1 is the default gateway. Separate additional addresses with commas, leaving a space before the default gateway.)

nmcli c modify ethernet connection.interface-name ens32 ipv4.method static ipv4.addresses "172.19.22.3/24 172.19.22.1" ipv4.dns 172.19.22.10,172.19.22.11 ipv4.dns-search mydomain.local

4. Bring up your new connection:

nmcli con up ethernet

5. delete a connection called "wired":

nmcli con delete wired

6. create a new connection (called "eth0") using an ethernet device called "ens32":

nmcli con add type ethernet con-name eth0 ifname ens32

7. change the hostname:

nmcli general hostname new_hostname

and restart hostnamed to pick up the change (your shell prompt won't change until you exec a new shell or reboot):

systemctl restart systemd-hostnamed

Secure Connection Failed With HP BL460c Blades in a C7000

I recently picked up some used blade servers on ebay. The problem was though the onboard administrator on the C7000 recognized them, neither Firefox nor IE could manage the web component of the blade as the certificate was long expired and from an untrusted CA (HP's self signed CA.)

The error message was:

*my ilo site* uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. (Error code: sec_error_unknown_issuer)

Adding an exception for the certificate failed. I found this link:

Mozilla's support site

Basically, you close firefox, delete cert8.db and start firefox again. After that, add the exception.

RedHat Enterprise/CentOS Kickstart with Bonding

In order to set up the bonded interfaces (in 802.3ad mode) when first booting, you'll need to supply the following arguments to kickstart:


ks=http://name_of_apache_server/myconfig.cfg ip=your.ip.address netmask=yournetmask gateway=yourgateway dns=nameserver1,nameserver2 hostname=yourfqdn bond=bond0:eth0,eth1:mode=802.3ad:miimon:100

OTRS ITSM - Simple template for CAB-Free Change

OTRS ITSM - Simple template for CAB-Free Change

ITSM with OTRS is a rather manual process. You can create conditions and move the state around, but the controls are limited; you cannot readily create a template that locks workorder state changes until the change is approved.

What you can do is create a template that simplifies some of the changes. The following flow adds an approval workorder, and requires that work order to be set to "closed" before the ticket changes to "approved."


1. Create a new change request with a name such as "my template"

2. Create a worked called "approval" with the type "approval" and with the text "APPROVAL TEMPLATE TEXT. PLEASE REPLACE"

3. Create a condition called "before approval" using the "AND" operator

add the following expressions:

object: workorder
selector:  1-approval
attribute: workorder
state operator: is
value: Accepted



and

object: change
selector: (pick the only change listed, the change you are on)
attribute: change state
operator: is
value: requested

It'll look something like this:

Then, add the following action:

object: change selector: (same change number as above) attribute: change state operator: set  value: pending approval


4. Save that condition and create a new condition "approved"

add this expression:

object: workorder
selector: 1-approval
attribute: workorder state
operator: is
value: closed

and this action:

object: change
  selector: (same change number as above)
attribute: change state
operator: set
value: approved

and save it.

It'll look like this:

5. Save this and click "template" on the menu. Choose a name.

6. When you create a new change, select "New (from template)"

Cisco VPN 3005 - Import XML Config

The Cisco 3005 VPN concentrator is most definitely a device past its prime. However, I still see them in the field (even though they should not be used.)

One problem that I've seen is that the GUI does not provide for a way to import the XML file that it so readily exports.

The answer is to use the CLI. First, upload the XML file to the file system in the GUI under file management and remember the name you used. Then connect to the device via serial or some other manner:

               Welcome to

               Cisco Systems

       VPN 3000 Concentrator Series

          Command Line Interface

Copyright (C) 1998-2005 Cisco Systems, Inc.

1) Configuration

2) Administration

3) Monitoring

4) Save changes to Config file

5) Help Information

6) Exit

From there, select 2, and you'll see:

1) Administer Sessions

2) Software Update

3) System Reboot

4) Reboot Status

5) Ping

6) Traceroute

7) Access Rights

8) File Management

9) Certificate Management

10) Back

Select 8

Which File to import XML from

Put in the name of the file you copied to the system using the GUI and you'll see:

Import successful.

Back out: 10 followed by 10 again, and save config. Reboot the system. You may need to re-import the XML as sometimes things like default gateways don't get set correctly on the first import.