Go to Qiita Advent Calendar 2024 Top
LoginSignup
1
1

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 5 years have passed since last update.

@HideoYamauchi(Hideo Yamauchi)

fence_dockerを使ってみる

Last updated at Posted at 2016-04-08

fece_dockerを単体で動かしてみます。

Pacemamaker1.0系から使われているglueでは、dockerリソースのfenceは出来ない為、今後、Pacemaker1.1系でdockerのSTONITHを利用する場合には、fence_docckerの利用が必要だと思われます。
今回は、TLS設定による利用は確認していません。

確認した環境

  • CentOS 7.2
  • Docker 1.9.1
  • fence-agents-a04398b16704e626ece91d1d60be77872eab6a7f

事前準備

docker-networkの設定

  • fence_dockerではネットワークアクセスが必要となる為、以下のような設定が必要です。
# /etc/sysconfig/docker-network
DOCKER_NETWORK_OPTIONS=-H tcp://0.0.0.0:4243 -H unix:///var/run/docker.sock
  • 設定反映の為に、dockerサービスを再起動します。
  • また、proxy環境ではproxyの例外設定が必要な場合もあるようです
[root@ct72-01　opt]# export no_proxy=localhost,127.0.0.1

アクセスの確認

  • 設定ネットワークでのdockerコマンドによるimagesの確認します。
[root@ct72-01 opt]# docker -H=tcp://localhost:4243 images
REPOSITORY          TAG                 IMAGE ID            CREATED             VIRTUAL SIZE
docker.io/centos    7                   28e524afdd05        6 days ago          196.7 MB
  • curlでimagesが取得出来ることも念の為、確認してみました。
[root@ct72-01 opt]# curl -X GET http://127.0.0.1:4243/images/json
[{"Id":"28e524afdd052cfa82227c67344c098aabcd51021dd1f3b0c71485abcdd78a86","ParentId":"044c0f15c4d9a7499734b75b73ea5754ceb2c1c22e86d7eaa5ab8098b60c5267","RepoTags":["docker.io/centos:7"],"RepoDigests":[],"Created":1459546102,"Size":0,"VirtualSize":196677849,"Labels":{"build-date":"2016-03-31","license":"GPLv2","name":"CentOS Base Image","vendor":"CentOS"}}]
  • 事前にコンテナを起動しておき、起動を確認します。
[root@ct72-01 opt]# docker ps 
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
2c49d5c99425        centos:7            "/bin/bash"         2 minutes ago       Up 2 minutes                            test1

#動作

  • -nオプションには、CONTAINER ID及びNAMESが指定可能です
  • 少し古いdockerのバージョンの場合には、api-versionのオプションを変更する必要があると思われます。

リスト取得

[root@ct72-01 opt]# fence_docker -o list  -a 127.0.0.1 -u 4243 --api-version 1.12
db7b85bba8160469a1a917a0c381b57a88629e0f41423508eb7988edb365440c,/boring_almeida
2c49d5c99425845e7b523257babbe563e0a0c5a96446b94f579dc2b8258bad28,/test1
add05522089ead63e244ce5ce97f4f5cdbf65d22a6dedf1a396bdcb503942809,/clever_perlman
a51db44e2397022b6ed5664155822f578afe9bb0ec93652b3686d23106734254,/sharp_archimedes

状態取得

[root@ct72-01 opt]# fence_docker -o status -a 127.0.0.1 -u 4243 -n test1 --api-version 1.12
Status: ON

電源OFF

[root@ct72-01 opt]# fence_docker -o off -a 127.0.0.1 -u 4243 -n test1 --api-version 1.12
Success: Powered OFF

[root@ct72-01 opt]# fence_docker -o status -a 127.0.0.1 -u 4243 -n test1 --api-version 1.12
Status: OFF

電源ON

  • 「Cannot parse json」と出るが、ONは可能な模様。
[root@ct72-01 opt]# fence_docker -o on -a 127.0.0.1 -u 4243 -n test1 --api-version 1.12
Cannot parse json
Success: Powered ON

[root@ct72-01 opt]# fence_docker -o status -a 127.0.0.1 -u 4243 -n test1 --api-version 1.12
Status: ON

リブート

  • 「Cannot parse json」と出るが、Rebootは可能な模様。
[root@ct72-01 opt]# fence_docker -o reboot -a 127.0.0.1 -u 4243 -n test1 --api-version 1.12
Cannot parse json
Success: Rebooted

[root@ct72-01 opt]# fence_docker -o status -a 127.0.0.1 -u 4243 -n test1 --api-version 1.12
Status: ON

その他

  • fence_dockerのコマンドラインのオプションは以下になっています。
[root@ct72-01 opt]# fence_docker --help
Usage:
        fence_docker [options]
Options:
   -a, --ip=[ip]                  IP address or hostname of fencing device
   -n, --plug=[id]                Physical plug number on device, UUID or
                                        identification of machine
   -m, --method=[method]          Method to fence (onoff|cycle) (Default: onoff)
   -z, --ssl                      Use SSL connection with verifying certificate
   -u, --ipport=[port]            TCP/UDP port to use
                                        (default 80, 443 if --ssl option is used)
   -4, --inet4-only               Forces agent to use IPv4 addresses only
   -6, --inet6-only               Forces agent to use IPv6 addresses only
   --ssl-secure                   Use SSL connection with verifying certificate
   --ssl-insecure                 Use SSL connection without verifying certificate
   -o, --action=[action]          Action: on, off, reboot (default), status, list,
                                        list-status, monitor, metadata or
                                        validate-all
   --tlscert                      Path to client certificate for TLS authentication
   --tlskey                       Path to client key for TLS authentication
   --tlscacert                    Path to CA certificate for TLS authentication
   -v, --verbose                  Verbose mode
   -D, --debug-file=[debugfile]   Debugging to output file
   -V, --version                  Display version information and exit
   -h, --help                     Display this help and exit
   -C, --separator=[char]         Separator for CSV created by 'list' operation
   --power-timeout=[seconds]      Test X seconds for status change after ON/OFF
   --shell-timeout=[seconds]      Wait X seconds for cmd prompt after issuing command
   --login-timeout=[seconds]      Wait X seconds for cmd prompt after login
   --power-wait=[seconds]         Wait X seconds after issuing ON/OFF
   --delay=[seconds]              Wait X seconds before fencing is started
   --retry-on=[attempts]          Count of attempts to retry power on
   --gnutlscli-path=[path]        Path to gnutls-cli binary
   --api-version                  Version of Docker Remote API (default: 1.11)

#PM2.0開発版のクラスタに組み込んでみました。(Bundle機能をdocker RAでマネテ見た感じです）

  • 以下の設定では、コンテナ内のDummyリソースをリネームなどすると、fence_dockerによって、コンテナが停止されます。
property no-quorum-policy="ignore" \
        stonith-action="off" \
        stonith-enabled="true" \
        startup-fencing="false" \

rsc_defaults resource-stickiness="INFINITY" \
        migration-threshold="1"
#

fencing_topology \
        docker-remote: prmStonith1

primitive prmStonith1 stonith:fence_docker \
        params pcmk_off_timeout=60s \
                ip="127.0.0.1" \
                ipport="4243" \
                api_version="1.12" \
                ssl_insecure=yes \
        op start interval="0s" timeout="60s" on-fail="restart" \
        op monitor interval="3600s" timeout="60s" on-fail="restart" \
        op stop interval="0s" timeout="60s" on-fail="ignore"

primitive docker-remote ocf:pacemaker:remote \
  params \        server="192.168.20.189" \
  op monitor interval=30s timeout=60s \

primitive vip-Docker ocf:heartbeat:IPaddr2 \
  	params \
    	ip="192.168.20.189" \
    	nic="ens192" \
    	cidr_netmask="24" \
        op start interval="0s" timeout="60s" on-fail="restart" \
        op monitor interval="10s" timeout="60s" on-fail="restart" \
        op stop interval="0s" timeout="60s" on-fail="block"

primitive container1 ocf:heartbeat:docker \
        params \
	        name="docker-remote" \
                run_opts="--restart=no -it -h docker-remote --name docker-remote -e PCMK_remote_port=3121 -v /etc/pacemaker/authkey:/etc/pacemaker/authkey -p 192.168.20.189:3121:3121 -p 192.168.20.189:80:80" \
                run_cmd="/usr/sbin/pacemaker_remoted" \
                image="pcmktest:http" \
	op start interval="0s" timeout="90s" on-fail="restart" \
	op monitor interval="3s" timeout="30s" on-fail="restart" \
	op stop interval="0s" timeout="90s" on-fail="fence"

primitive dummy-on-remote ocf:heartbeat:Dummy \
  op start interval=0s timeout=60s \
  op monitor interval=30s timeout=60s \
  op stop interval=0s timeout=60s on-fail="fence"


group grpDocker \
	vip-Docker \
	container1
	
location location-1 grpDocker resource-discovery="exclusive" \
	rule 100: #uname eq rh74-test

location location-2 docker-remote resource-discovery="exclusive" \
	rule 100: #uname eq rh74-test

location location-3 dummy-on-remote resource-discovery="exclusive" \
	rule 100: #uname eq docker-remote

### Resource Order ###
colocation col-1 inf: docker-remote grpDocker
order rsc_order-1 inf: grpDocker docker-remote

関連リンク

以上です

1
1
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
1
1

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?