Hi Piotr, Thanks for the review. :)
The concept of "weak membership model" (which is equivalent to multiple_partitions=true setting right now) has a requirement that the cluster should have no quorum devices configured. To put it differently, if there are any quorum devices configured, then the cluster cannot be using "weak membership model"; it will be "strong membership model". So, the sequence of steps is as mentioned in the doc : (i) first change to strong membership model by setting multiple_partitions=false (ii) add a quorum device for higher availability I understand you are saying that if a node goes down in between steps (i) and (ii) above, then there will be a loss of quorum. But let me try to argue like this : - going by the notion that weak membership means no quorum devices, the CLI prevents addition of any quorum devices when cluster is running weak membership. So how does CLI know that the user really intends to add a quorum device with an intention to switch to strong membership? - alternately, the software could have the behaviour that as soon as a user adds a quorum device, the cluster switches to strong membership automatically. But it is not very good to do such 'automated' actions when we do not really know what the user was intending to do; I mean, the user intends to do action1, but we also automatically perform action2 additionally in the background. - besides, removal of the last quorum device from a 2-node cluster is anyway allowed under strong membership; let's trust the admin to know what he/she is doing. :) Hoping I could answer some of your queries... Thanks & Regards, Sambit Piotr Jasiukajtis wrote: > Weak Membership design: > > "6.4 To Switch from Weak to Strong membership model > 1. In order to switch from Weak to Strong membership model, the > cluster must be fully > formed. In other words, both nodes must be up and both nodes must be > in the same cluster > partition. The transition cannot be done while the cluster is in a > split-brain condition. > 2. Set the multiple_partitions property to false to switch to Strong > membership. > clq set -p multiple_partitions=false membership > 3. Now add a quorum device (quorum server or a shared disk) to provide > high availability. Without a quorum device, any disconnect between > the cluster nodes or single > node failure will result in complete cluster panic. > clq add d3" > > Well, I think 'clq add d3' should be in the first place so the proper > sequence would looks like: > # clq add d3 > # clq set -p multiple_partitions=false membership > > This prevents the cluster panic. > >
