AWS sap high security documentation change
Summary
Updated STONITH fencing configuration to recommend fence_aws agent for SLES 15 SP5+, added detailed parameters for fence_aws, maintained external/ec2 for older versions, and included migration instructions between agents.
Security assessment
The change documents critical security improvements in fencing operations: 1) Introduces skip_os_shutdown parameter to force-stop unresponsive instances, 2) Adds pcmk_reboot_retries to handle failed reboots, 3) Updates fencing timeouts and delays to prevent split-brain scenarios. These directly impact cluster security by ensuring reliable node isolation during failures.
Diff
diff --git a/sap/latest/sap-netweaver/cluster-config-nw-sles.md b/sap/latest/sap-netweaver/cluster-config-nw-sles.md index 9e9825f49..51c77a02a 100644 --- a//sap/latest/sap-netweaver/cluster-config-nw-sles.md +++ b//sap/latest/sap-netweaver/cluster-config-nw-sles.md @@ -7 +7 @@ -Prepare for Resource CreationCluster BootstrapCreate STONITH (external/ec2) resourceCreate Filesystem resources (classic only)Create Overlay IP (aws-vpc-move-ip) resourcesCreate SAPStartSrv resources (simple-mount only)Create SAPInstance resources (simple-mount only)Create SAPInstance resources (classic only)Create resource groups for aws-vpc-move-ip / SAPStartSrv / SAPInstance (simple-mount only)Create resource groups for Filesystem / aws-vpc-move-ip / SAPInstance (classic only)Create resource constraintsReset Configuration – Optional +Prepare for Resource CreationCluster BootstrapCreate STONITH Fencing ResourceCreate Filesystem resources (classic only)Create Overlay IP (aws-vpc-move-ip) resourcesCreate SAPStartSrv resources (simple-mount only)Create SAPInstance resources (simple-mount only)Create SAPInstance resources (classic only)Create resource groups for aws-vpc-move-ip / SAPStartSrv / SAPInstance (simple-mount only)Create resource groups for Filesystem / aws-vpc-move-ip / SAPInstance (classic only)Create resource constraintsReset Configuration – Optional @@ -19 +19 @@ The following sections provide details on the resources, groups and constraints - * Create STONITH (external/ec2) resource + * Create STONITH Fencing Resource @@ -137 +137 @@ To verify your operation default settings: -## Create STONITH (external/ec2) resource +## Create STONITH Fencing Resource @@ -139 +139 @@ To verify your operation default settings: -Create the STONITH or Fencing resource using resource agent **`external/ec2` **: +Create the STONITH or Fencing resource. As of SLES 15 SP5 with the latest fence-agents package, we recommend resource agent `fence_aws`. For older SLES versions, the `stonith:external/ec2` resource is supported. @@ -140,0 +141 @@ Create the STONITH or Fencing resource using resource agent **`external/ec2` **: +fence_aws (SLES 15 SP5 and above) @@ -142,3 +143,10 @@ Create the STONITH or Fencing resource using resource agent **`external/ec2` **: - # crm configure primitive <stonith_resource_name> stonith:external/ec2 \ - params tag="<cluster_tag>" profile="<cli_cluster_profile>" pcmk_delay_max="<delay_value>" \ - op start interval="0" timeout="180" \ + + + # crm configure primitive <stonith_resource_name> stonith:fence_aws \ + params pcmk_host_map="<hostname_1>:<instance_id_1>;<hostname_2>:<instance_id_2>" \ + region="<aws_region>" \ + skip_os_shutdown="true" \ + pcmk_delay_max="<delay_value>" \ + pcmk_reboot_timeout="600" \ + pcmk_reboot_retries="4" \ + op start interval="0" timeout="600" \ @@ -150 +158 @@ Details: - * **tag** \- EC2 instance tag key name that associates instances with this cluster configuration. This tag key must be unique within the AWS account and have a value which matches the instance hostname. See [Create Amazon EC2 Resource Tags Used by Amazon EC2 STONITH Agent](./sap-nw-pacemaker-sles-ec2-configuration.html#create-cluster-tags-nw-sles) for EC2 instance tagging configuration. + * **pcmk_host_map** \- Maps cluster node hostnames to their EC2 instance IDs. This mapping must be unique within the AWS account and follow the format hostname:instance-id, with multiple entries separated by semicolons. @@ -152 +160,5 @@ Details: - * **profile** \- (optional) AWS CLI profile name for API authentication. Verify profile exists with `aws configure list-profiles`. If a profile is not explicitly configured the default profile will be used. + * **region** \- AWS region where the EC2 instances are deployed + + * **pcmk_delay_max** \- Random delay before fencing operations. Works in conjunction with cluster property `priority-fencing-delay` to prevent simultaneous fencing in 2-node clusters. For ENSA1 use 30 seconds, for ENSA2 use 10 seconds (lower value sufficient as `priority-fencing-delay` handles primary node protection). Omit in clusters with real quorum (3+ nodes) to avoid unnecessary delay. + + * **pcmk_reboot_timeout** \- Maximum time in seconds allowed for a reboot operation @@ -154 +166 @@ Details: - * **pcmk_delay_max** \- Random delay before fencing operations. Works in conjunction with cluster property `priority-fencing-delay` to prevent simultaneous fencing om 2-node clusters. For ENSA1 use 30 seconds, for ENSA2 use 10 seconds (lower value sufficient as `priority-fencing-delay` handles primary node protection). Omit in clusters with real quorum (3+ nodes) to avoid unnecessary delay. + * **pcmk_reboot_retries** \- Number of times to retry a failed reboot operation @@ -155,0 +168,3 @@ Details: + * **skip_os_shutdown** (recommended) - Leverages a new ec2 stop-instance API flag to forcefully stop an EC2 Instance by skipping the shutdown of the Operating System. + +_Example using values from[Parameter Reference](./sap-nw-pacemaker-sles-parameters.html) _: @@ -156,0 +172,10 @@ Details: + # crm configure primitive rsc_fence_aws stonith:fence_aws \ + params pcmk_host_map="slxhost01:i-xxxxinstidforhost1;slxhost02:i-xxxxinstidforhost2" \ + region="us-east-1" \ + skip_os_shutdown="true" \ + pcmk_delay_max="10" \ + pcmk_reboot_timeout="600" \ + pcmk_reboot_retries="4" \ + op start interval="0" timeout="600" \ + op stop interval="0" timeout="180" \ + op monitor interval="300" timeout="60" @@ -159 +183,0 @@ Details: -###### Example @@ -161 +184,0 @@ Details: -ENSA1 @@ -162,0 +186 @@ ENSA1 +external/ec2 (older SLES versions) @@ -164 +187,0 @@ ENSA1 -_Example using values from[Parameter Reference](./sap-nw-pacemaker-sles-parameters.html) _: @@ -167,3 +190,2 @@ _Example using values from[Parameter Reference](./sap-nw-pacemaker-sles-paramete - # crm configure primitive res_stonith_ec2 stonith:external/ec2 \ - params tag="pacemaker" profile="cluster" \ - pcmk_delay_max="30" \ + # crm configure primitive <stonith_resource_name> stonith:external/ec2 \ + params tag="<cluster_tag>" profile="<cli_cluster_profile>" pcmk_delay_max="<delay_value>" \ @@ -174 +196 @@ _Example using values from[Parameter Reference](./sap-nw-pacemaker-sles-paramete -ENSA2 +Details: @@ -175,0 +198 @@ ENSA2 + * **tag** \- EC2 instance tag key name that associates instances with this cluster configuration. This tag key must be unique within the AWS account and have a value which matches the instance hostname. See [Create Amazon EC2 Resource Tags Used by Amazon EC2 STONITH Agent](./sap-nw-pacemaker-sles-ec2-configuration.html#create-cluster-tags-nw-sles) for EC2 instance tagging configuration. @@ -177 +200,3 @@ ENSA2 -_Example using values from[Parameter Reference](./sap-nw-pacemaker-sles-parameters.html) _: + * **profile** \- (optional) AWS CLI profile name for API authentication. Verify profile exists with `aws configure list-profiles`. If a profile is not explicitly configured the default profile will be used. + + * **pcmk_delay_max** \- Random delay before fencing operations. Works in conjunction with cluster property `priority-fencing-delay` to prevent simultaneous fencing in 2-node clusters. For ENSA1 use 30 seconds, for ENSA2 use 10 seconds (lower value sufficient as `priority-fencing-delay` handles primary node protection). Omit in clusters with real quorum (3+ nodes) to avoid unnecessary delay. @@ -178,0 +204 @@ _Example using values from[Parameter Reference](./sap-nw-pacemaker-sles-paramete +_Example using values from[Parameter Reference](./sap-nw-pacemaker-sles-parameters.html) _: @@ -186,0 +213,30 @@ _Example using values from[Parameter Reference](./sap-nw-pacemaker-sles-paramete + + + +###### Note + +**Migrating from`external/ec2` to `fence_aws` ** + +Ensure fence-agents is updated to the latest available version on all cluster nodes: + + + # zypper refresh + # zypper up fence-agents + +On SLES 15 SP5 and SP6, the following Python 3.11 packages are also required as dependencies for `fence_aws`: + + + # zypper install python311-pycurl python311-pexpect + +Then place the cluster in maintenance mode, delete the existing STONITH resource, create the new `fence_aws` resource, and disable maintenance mode: + + + # crm maintenance on + # crm configure delete <old_stonith_resource_name> + # crm configure primitive <new_stonith_resource_name> stonith:fence_aws \ + params pcmk_host_map="<hostname_1>:<instance_id_1>;<hostname_2>:<instance_id_2>" \ + region="<aws_region>" ... + # crm maintenance off + +EC2 instance tags used by `external/ec2` can remain in place — they do not interfere with `fence_aws`. +