On Thu, 2019-12-19 at 15:01 +0000, Marcus Vinicius wrote: > Hi, > > As I know, CLUSTERIP is deprecated for some time. Recent > distributions doesn't have this module on their repositories at all > (Red Hat 8) > > It seems Pacemaker still use CLUSTERIP for clone an IP address. > > For this reason, I have the following error on an Active/Active > cluster VIP: > > Cenario: > > CentOS 8 > Pacemaker 2.0.1 > Kernel 4.18.0 > Iptables 1.8.2 > > # pcs resource create ClusterIP ocf:heartbeat:IPaddr2 > ip=172.18.14.100 nic=ens160 cidr_netmask=24 op monitor interval=2s > # pcs resource clone ClusterIP > # pcs status > ... > Failed Resource Actions: > * ClusterIP_start_0 on pcsnode1 'unknown error' (1): call=40, > status=complete, exitreason='iptables failed', > last-rc-change='Thu Dec 19 12:30:40 2019', queued=0ms, exec=172ms > > Logs: > > Dec 19 12:32:54 pcsnode1 IPaddr2(ClusterIP)[10245]: ERROR: iptables > failed > Dec 19 12:32:54 pcsnode1 pacemaker-execd[1436]: notice: > ClusterIP_start_0:10245:stderr [ iptables v1.8.2 (nf_tables): chain > name not allowed to start with `-' ] > Dec 19 12:32:54 pcsnode1 pacemaker-execd[1436]: notice: > ClusterIP_start_0:10245:stderr [ ] > Dec 19 12:32:54 pcsnode1 pacemaker-execd[1436]: notice: > ClusterIP_start_0:10245:stderr [ Try `iptables -h' or 'iptables -- > help' for more information. ] > Dec 19 12:32:54 pcsnode1 pacemaker-execd[1436]: notice: > ClusterIP_start_0:10245:stderr [ ocf-exit-reason:iptables failed ] > Dec 19 12:32:54 pcsnode1 pacemaker-controld[1439]: notice: Result of > start operation for ClusterIP on pcsnode1: 1 (unknown error) > > Any one can simulate the module problem, outside Pacemaker, with this > command: > > Perfectly good for CentOS 7 installation with ipt_CLUSTERIP.ko: > > # iptables -A INPUT -d 172.18.14.100/32 -i ens192 -j CLUSTERIP --new > --hashmode sourceip-sourceport --clustermac 43:0A:1F:80:58:36 -- > total-nodes 2 --local-node 2 --hash-init 0 > > No good for a default CentOS 8 installation: > > # iptables -A INPUT -d 172.18.14.100/32 -i ens192 -j CLUSTERIP --new > --hashmode sourceip-sourceport --clustermac 43:0A:1F:80:58:36 -- > total-nodes 2 --local-node 2 --hash-init 0 > iptables v1.8.2 (nf_tables): chain name not allowed to start with `-' > > Try `iptables -h' or 'iptables --help' for more information. > > > Is there any intention to abandon CLUSTERIP
yes > in favor of xt_cluster.ko? no :) A recent thread about this: https://lists.clusterlabs.org/pipermail/users/2019-December/026663.html resulted in a change to allow IPaddr2 clones to continue working on newer systems if "iptables-legacy" is available: https://github.com/ClusterLabs/resource-agents/pull/1439 tl;dr Cloned IPaddr2 is supported only on platforms that support CLUSTERIP, and can be considered deprecated since CLUSTERIP itself is deprecated. A pull request with an xt_cluster implementation would be very welcome, as it's a low priority for available developers. > Thanks a lot! > > > Att, > > Marcus Vinícius -- Ken Gaillot <kgail...@redhat.com> _______________________________________________ Manage your subscription: https://lists.clusterlabs.org/mailman/listinfo/users ClusterLabs home: https://www.clusterlabs.org/