Hi Sathish,
apology for the super late reply. I have been on sick leave for a long time.
comments inline
On 30/01/2023 08.38, S Sathish S wrote:
> Hi Team,
>
> In our application we are currently using UDPU as transport protocol
> with single ring, while migrated to corosync 3.x knet become default
> protocol.
>
> We need to understand any maintenance overhead that any required
> certificate/key management would bring in for knet transport protocol
> (or) it
>
> will use existing authorization key /etc/corosync/authkey file for
> secure communication between nodes using knet transport protocol.
there is no extra maintenance. In fact, knet should make it easier.
corosync will continue to use the same authkey and load it into knet.
knet and corosync, in recent versions also allow runtime change of the
authkey without shutting down the cluster and restart. It should be
possible to update authkey and issue a config reload for corosync.
This feature requires all nodes of the cluster to be online.
>
> https://access.redhat.com/solutions/5963941
> <https://access.redhat.com/solutions/5963941>
>
> https://access.redhat.com/solutions/1182463
> <https://access.redhat.com/solutions/1182463>
>
> We shouldn't end up in a case where Pacemaker stops working due to some
> certificate/key expiry?
No, that won´t be the case as knet and corosync use a different
encryption method than pacemaker.
Cheers
Fabio
>
> Thanks and Regards,
>
> S Sathish S
>
>
> _______________________________________________
> Users mailing list -- users(a)lists.kronosnet.org
> To unsubscribe send an email to users-leave(a)lists.kronosnet.org
All,
We are pleased to announce the general availability of kronosnet v1.22.
*** This release includes several MAJOR bug fixes and we strongly
encourage everyone to update as soon as possible ***
kronosnet (or knet for short) is the new underlying network protocol for
Linux HA components (corosync), that features the ability to use
multiple links between nodes, active/active and active/passive link
failover policies, automatic link recovery, FIPS compliant encryption
(nss and/or openssl), automatic PMTUd and in general better performance
compared to the old network protocol.
Highlights in this release:
* Fix incorrect defrag buffer index that can cause knet to stop
processing all traffic under some extreme network conditions (random
latency).
* Increase defrag buffer size to better deal with extreme network
conditions as above.
* Do not leak resources if link configuration fails
* Major rework of ACL code to match API vs implementation.
* Detect incorrect link configuration when mixing static and dynamic
links
* Fix knet_send_sync API to require a destination filter
* Fix knet sockaddr_storage size across the board to deal with newly
introduced checks on FreeBSD
* Minor docs updates
* Major internal test suite fixes
Known issues in this release:
* Preparation for this release spotted a long standing issue with SCTP
transport used in combination with dynamic links. This specific issue
has been in the code since SCTP has been introduced. It will be
addressed in one of the upcoming releases. The problem does NOT affect
the corosync / High Availability use case.
The source tarballs can be downloaded here:
https://www.kronosnet.org/releases/
Upstream resources and contacts:
https://kronosnet.org/https://github.com/kronosnet/kronosnet/https://ci.kronosnet.org/https://trello.com/kronosnet (TODO list and activities tracking)
https://goo.gl/9ZvkLS (google shared drive with presentations and diagrams)
IRC: #kronosnet on Freenode
https://lists.kronosnet.org/mailman/listinfo/usershttps://lists.kronosnet.org/mailman/listinfo/develhttps://lists.kronosnet.org/mailman/listinfo/commits
Cheers,
The knet developer team
All,
We are pleased to announce the general availability of kronosnet v1.21
kronosnet (or knet for short) is the new underlying network protocol for
Linux HA components (corosync), that features the ability to use
multiple links between nodes, active/active and active/passive link
failover policies, automatic link recovery, FIPS compliant encryption
(nss and/or openssl), automatic PMTUd and in general better performance
compared to the old network protocol.
Highlights in this release:
* Update to openssl 3.0alpha13
* Drop -rpath usage from libknet
* Various libnozzle fixes
* API: validate handles for public api calls to avoid crashes
* Update FreeBSD documentation section
* Test suite improvements to speed up testing
Known issues in this release:
* None
The source tarballs can be downloaded here:
https://www.kronosnet.org/releases/
Upstream resources and contacts:
https://kronosnet.org/https://github.com/kronosnet/kronosnet/https://ci.kronosnet.org/https://trello.com/kronosnet (TODO list and activities tracking)
https://goo.gl/9ZvkLS (google shared drive with presentations and diagrams)
IRC: #kronosnet on Freenode
https://lists.kronosnet.org/mailman/listinfo/usershttps://lists.kronosnet.org/mailman/listinfo/develhttps://lists.kronosnet.org/mailman/listinfo/commits
Cheers,
The knet developer team
Hi folks,
Thank you for your time and will to help.
We are in the middle of a high pressure because some problems with RHEL HA Cluster/Corosync+Pacemaker/DRBD and we arrived at the point that we upgraded corosync 2.4.3 to 3.1 and pacemaker 1.1.20 to 2.1 but then our setup gives errors with the command
"pcs property set no-quorum-policy=stop".
The error is:
No such file or directory', 'command': '/usr/libexec/pacemaker/pengine metadata'
Indeed /usr/libexec/pacemaker/pengine does not exists, I assume it is OK, because in the new pacemaker 3.1 the internal structure was changed..
In the midtime we found out that we could archive the same setting using crm_attribute --name no-quorum-policy -update stop.
My questions are:
* Is there a reason that pcs has no build for RHEL 7?
* Is the crm_attribute the right choice for setting cluster properties and will cover all usecases?
*
Thank You!
BR,
Szabolcs