Currently, masakari-hostmonitor sends a notification with “NORMAL” host_status when it confirms a failed host gets power off, otherwise it sends a notification with “UNKNOWN” host_status. However, when masakari-api receives a notification, it executes the failover process regardless the value of host_status.
If a failed host remains power on for some reasons and VM instances are still running on the host, those instances are requested to evacuate through Nova API. Moreover, if nova-compute is ‘down’ status and corosync is ‘offline’ status due to network infrastructure instability or so, the failover of VM instances are executed even though existing VM instances are not fenced, which is dangerous and may cause unavailable instance and data loss.
To avoid unsafe failover, the failover process must not be triggered by a notification with “UNKNOWN” host_status.
Fix proposed to branch: master
Review: https:/