LEARN. PRACTICE. GROW.Concept and mechanism
Losing communication with a node does not prove it stopped writing. In a cluster with shared resources, promoting another writer without isolation can compromise integrity. Fencing should work during the failures it is meant to contain; an SSH request to the target itself depends on components that may have failed. Concrete design varies with cluster, storage, and isolation mechanism and needs rehearsal. Do not disable protection merely to obtain a green dashboard. Replication also does not replace recoverable history: an incorrect deletion can quickly reach every current copy. Recovering an earlier state requires an appropriate validated capability.
Guided application
In a fictional cutover, the previous image exists but data has migrated to an incompatible format. Executable rollback does not demonstrate complete recovery. Define compatibility, restore, stopping criteria, and owners before the window. In Ansible, run_once with serial can execute once per batch; a global migration needs its own design, including repetition control. For RUN, validate operational access and recovery by the people who will own the service without dependence on the author’s personal credential. If evidence is missing, present the risk to the decision owner and distinguish deferral, redesign, or residual-risk acceptance through the applicable process. These cases are fictional and do not represent any bank’s internal procedures.
Two nodes without heartbeat can still write; promotion speed does not prove safety.
Common pitfalls
Missing heartbeat as powered-off node; replica as history; image rollback as data rollback; run_once as global.
Related topics: Automate with evidence · Operate and recover systems · Identity, PAM, and SSH
Delivery includes recovery with integrity by the team that will operate.
Reference: Pacemaker 3 fencing · Historical LFCE V3.18 (2018-06-12); exam retired 2022-05-01; technical references inspected 2026-09-30