Update Clusters From Scratch for pacemaker-3.0 / Alma Linux 10

doc/sphinx/Clusters_from_Scratch/cluster-setup.rst

@@ -49,7 +49,7 @@ that will make our lives easier:
 
 .. code-block:: console
 
-    # dnf install -y pacemaker pcs psmisc policycoreutils-python3
+    # dnf install -y pacemaker pcs psmisc policycoreutils-python3 policycoreutils-python-utils
 
 .. NOTE::
 
@@ -303,11 +303,167 @@ example of all the options available under the status category.
         xml
             View xml version of status (output from crm_mon -r -1 -X).
 
+        wait [<timeout>]
+            Wait for the cluster to settle into stable state. Timeout can be
+            specified as bare number which describes number of seconds or number
+            with unit (s or sec for seconds, m or min for minutes, h or hr for
+            hours). If 'timeout' is not specified or set to zero, it defaults to
+            60 minutes.
+            Example: pcs status wait 30min
+
+        query resource <resource-id> exists [--quiet]
+            Query the existence of the resource.
+
+            Print 'True' and exit with 0 if the query evaluates to true. Exit with
+            1 if an error occurs while performing the query. Print 'False' and exit
+            with 2 otherwise.
+            If --quiet is specified, do not print any output and just exit with
+            the appropriate return code.
+
+        query resource <resource-id> is-stonith [--quiet]
+            Query if the resource is a stonith resource.
+
+            Print 'True' and exit with 0 if the query evaluates to true. Exit with
+            1 if an error occurs while performing the query. Print 'False' and exit
+            with 2 otherwise.
+            If --quiet is specified, do not print any output and just exit with
+            the appropriate return code.
+
+        query resource <resource-id> is-type [--quiet]
+                (primitive | group | clone [unique] [promotable] | bundle [unique])
+            Query if the resource is of given type. Allows to query whether clones
+            are globally unique or promotable. Allows to query whether bundles are
+            globally unique.
+
+            Print 'True' and exit with 0 if the query evaluates to true. Exit with
+            1 if an error occurs while performing the query. Print 'False' and exit
+            with 2 otherwise.
+            If --quiet is specified, do not print any output and just exit with
+            the appropriate return code.
+
+        query resource <resource-id> get-type
+            Get type of the resource. The output is one of 'primitive', 'group',
+            'clone', 'clone unique', 'clone promotable', 'clone unique promotable',
+            'bundle' or 'bundle unique'.
+
+        query resource <resource-id> is-state <state> [on-node <node-name>]
+                [members all|any|none] [instances all|any|none] [--quiet]
+            Query if the resource is in the given state. <state> can be one of
+            'active', 'blocked', 'demoting', 'disabled', 'enabled', 'failed',
+            'failure_ignored', 'locked_to', 'maintenance', 'managed', 'migrating',
+            'monitoring', 'orphaned', 'pending', 'promoted', 'promoting', 'started',
+            'starting', 'stopped', 'stopping', 'unmanaged' or 'unpromoted'.
+
+            States 'starting', 'stopping', 'promoting', 'demoting', 'migrating' and
+            'monitoring' describe that resource operation (start, stop, promote,
+            demote, migrate_from/to, or monitor) is currently in progress on the
+            resource. 'pending' will evaluate to true if any of these operations is
+            currently in progress on the resource.
+
+            State 'locked_to' allows to specify node name of the node that the
+            resource is locked to.
+
+            With groups, the state is read and evaluated on the group first. If the
+            state cannot be determined from only the group, evaluate the state of
+            the member resources and return true if the query is true for ALL of
+            the members. 'members' can be used to specify how to evaluate the states
+            of the members. If 'members' is specified, then always evaluate the
+            query only on the member resources without looking at the group itself.
+            This means that for example queries for 'started' and 'stopped' on a
+            group with one started and one stopped member will both evaluate as
+            false at the same time if 'members' is not specified or it is set to
+            'all'.
+
+            With clones and bundles, the state is read and evaluated on the clone
+            or bundle first. If the state cannot be determined from only the clone
+            or bundle, evaluate the state on the instances and return true if the
+            query is true for ANY of the instances. 'instances' can be used to
+            specify how to evaluate the state of the instances. If 'instances'
+            is specified, then always evaluate the query only on the instances
+            without looking at the clone or bundle themselves. This means that for
+            example queries for 'started' and 'stopped' on a clone with one started
+            and one stopped instance will both evaluate as true at the same time if
+            'instances' is not specified or it is set to 'any'.
+
+            'on-node' can be used to test whether the resource is in given state on
+            the node with the given name. If 'on-node' is used, then always check
+            only the member resources for groups and instances for clones or
+            bundles.
+
+            Queries on the state of cloned or bundled resources are evaluated
+            similarly to queries on clones or bundles. Evaluate the state of every
+            instance and return true if the query is true for ANY of the instances.
+            'instances' can be used to specify how the query should be evaluated.
+            It is possible to query single specific instance of unique clones or
+            bundles by using resource id together with the suffix that distinguishes
+            instances for unique clones and bundles.
+            Example: Query if any instance of resource is started
+                pcs status query resource resource_id is-state started
+            Example: Query if one specific instance is started
+                pcs status query resource resource_id:0 is-state started
+
+            Print 'True' and exit with 0 if the query evaluates to true. Exit with
+            1 if an error occurs while performing the query. Print 'False' and exit
+            with 2 otherwise.
+            If --quiet is specified, do not print any output and just exit with
+            the appropriate return code.
+
+        query resource <resource-id> is-in-group [<group-id>] [--quiet]
+            Query if the resource is in any group or in a group with the
+            specified id.
+
+            Print 'True' and exit with 0 if the query evaluates to true. Exit with
+            1 if an error occurs while performing the query. Print 'False' and exit
+            with 2 otherwise.
+            Print the id of the group on new line if the resource is in any group.
+            If --quiet is specified, do not print any output and just exit with
+            the appropriate return code.
+
+        query resource <resource-id> is-in-clone [<clone-id>] [--quiet]
+            Query if the resource is in any clone or in a clone with the specified
+            id. Resource that is in a cloned group is considered to be in the clone
+            itself.
+
+            Print 'True' and exit with 0 if the query evaluates to true. Exit with
+            1 if an error occurs while performing the query. Print 'False' and exit
+            with 2 otherwise.
+            Print the id of the clone on new line if the resource is in any clone.
+            If --quiet is specified, do not print any output and just exit with
+            the appropriate return code.
+
+        query resource <resource-id> is-in-bundle [<bundle-id>] [--quiet]
+            Query if the resource is in any bundle or in a bundle with the
+            specified id.
+
+            Print 'True' and exit with 0 if the query evaluates to true. Exit with
+            1 if an error occurs while performing the query. Print 'False' and exit
+            with 2 otherwise.
+            Print the id of the bundle on new line if the resource is in any bundle.
+            If --quiet is specified, do not print any output and just exit with
+            the appropriate return code.
+
+        query resource <resource-id> get-nodes
+            Get all nodes on which the resource is running. With groups, return
+            nodes on which any of the members is running. For clones or bundles,
+            return nodes on which any of the instances or replicas are running.
+
+            Print each node name on new line.
+
+        query resource <resource-id> get-members
+            Get ids of member resources of the resource. Only useful for group,
+            clone and bundle resources.
+
+            Print each member id on new line.
+
+        query resource <resource-id> get-index-in-group
+            Get an index of the resource in a group. The first resource in a group
+            has an index of 0. Usable only for resources that are in a group.
+
 Additionally, if you are interested in the version and supported cluster stack(s)
 available with your Pacemaker installation, run:
 
 .. code-block:: console
 
     [root@pcmk-1 ~]# pacemakerd --features
-     Pacemaker 2.1.2-4.el9 (Build: ada5c3b36e2)
-     Supporting v3.13.0: agent-manpages cibsecrets corosync-ge-2 default-resource-stickiness default-sbd-sync generated-manpages monotonic nagios ncurses remote systemd
+     Pacemaker 3.0.1-3.el10 (Build: 6a90427)
+     Supporting v3.21.1: agent-manpages cibsecrets corosync-ge-2 default-resource-stickiness default-sbd-sync generated-manpages lsb monotonic ncurses service systemd

doc/sphinx/Clusters_from_Scratch/installation.rst

@@ -9,10 +9,10 @@ ______________________
 
 Download the latest |CFS_DISTRO| |CFS_DISTRO_VER| DVD ISO by navigating to
 the |CFS_DISTRO| `mirrors list <https://mirrors.almalinux.org/isos.html>`_,
-selecting the latest 9.x version for your machine's architecture, selecting a
-download mirror that's close to you, and finally selecting the latest .iso file
-that has “dvd” in its name. Use the image to boot a virtual machine, or burn it
-to a DVD or USB drive and boot a physical server from that.
+selecting the latest |CFS_DISTRO_VER|.x version for your machine's architecture,
+selecting a download mirror that's close to you, and finally selecting the latest
+.iso file that has “dvd” in its name. Use the image to boot a virtual machine, or
+burn it to a DVD or USB drive and boot a physical server from that.
 
 After starting the installation, select your language and keyboard layout at
 the welcome screen.
@@ -89,9 +89,9 @@ Enter the **INSTALLATION DESTINATION** section and select the disk where you
 want to install the OS. Then under **Storage Configuration**, select **Custom**
 and press **Done**.
 
-.. figure:: images/ManualPartitioning.png
+.. figure:: images/InstallationDestination.png
     :align: center
-    :alt: Installation Destination Screen
+    :alt: Screen
 
     |CFS_DISTRO| |CFS_DISTRO_VER| Installation Destination Screen
 
@@ -144,21 +144,34 @@ settings (such as time zone or NTP server), you can do this in the
 
     |CFS_DISTRO| |CFS_DISTRO_VER| Time & Date Screen
 
-
-Root Password
+Root Account
 ______________________________
 
-In order to continue to the next step, a **Root Password** must be set. Be sure
-to check the box marked **Allow root SSH login with password**.
+In the **ROOT ACCOUNT** section, it is highly recommended to disable the root
+account.  We'll use a local user to perform administration tasks with sudo.
 
 .. figure:: images/RootPassword.png
     :align: center
-    :alt: Root Password Screen
+    :alt: Root Account Screen
+
+    |CFS_DISTRO| |CFS_DISTRO_VER| Root Account Screen
+
+Press **Done**.
+
+Create User
+______________________________
+
+In the **CREATE USER** section, create a new user with a secure password.  Make
+sure to select **Add administrative privileges to the user account (wheel group
+membership)** so the user can administer the system.
+
+.. figure:: images/CreateUser.png
+    :align: center
+    :alt: Create User Screen
 
-    |CFS_DISTRO| |CFS_DISTRO_VER| Root Password Screen
+    |CFS_DISTRO| |CFS_DISTRO_VER| Create User Screen
 
-Press **Done**. (Depending on the password you chose, you may need to do so
-twice.)
+Press **Done**.
 
 Finish Install
 ______________
@@ -219,7 +232,7 @@ Next, ensure that the routes are as expected:
 .. code-block:: console
 
     [root@pcmk-1 ~]# ip route
-    default via 192.168.122.1 dev enp1s0 proto static metric 100
+    default via 192.168.122.1 dev enp1s0 proto static 192.168.122.101 metric 100
     192.168.122.0/24 dev enp1s0 proto kernel scope link src 192.168.122.101 metric 100
 
 If there is no line beginning with ``default via``, then use ``nmcli`` to add a
@@ -266,26 +279,33 @@ From another host, check whether we can see the new host at all:
 
 .. code-block:: console
 
-    [gchin@gchin ~]$ ping -c 1 192.168.122.101
+    [chris@laptop ~]$ ping -c 1 192.168.122.101
     PING 192.168.122.101 (192.168.122.101) 56(84) bytes of data.
     64 bytes from 192.168.122.101: icmp_seq=1 ttl=64 time=0.344 ms
 
     --- 192.168.122.101 ping statistics ---
     1 packets transmitted, 1 received, 0% packet loss, time 0ms
     rtt min/avg/max/mdev = 0.344/0.344/0.344/0.000 ms
 
-Next, login as ``root`` via SSH.
+Next, login as the user you created during installation via SSH.
 
 .. code-block:: console
 
-    [gchin@gchin ~]$ ssh root@192.168.122.101
+    [chris@laptop~]$ ssh 192.168.122.101
     The authenticity of host '192.168.122.101 (192.168.122.101)' can't be established.
     ECDSA key fingerprint is SHA256:NBvcRrPDLIt39Rf0Tz4/f2Rd/FA5wUiDOd9bZ9QWWjo.
+    This key is not known by any other names.
     Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
     Warning: Permanently added '192.168.122.101' (ECDSA) to the list of known hosts.
-    root@192.168.122.101's password:
-    Last login: Tue Jan 10 20:46:30 2021
-    [root@pcmk-1 ~]#
+    chris@192.168.122.101's password:
+    Last login: Tue Feb 24 13:03:51 2026
+    [chris@pcmk-1 ~]#
+
+.. NOTE::
+
+    From here on, you'll need to be ``root`` to administer the system.  The
+    ``sudo`` command can be used to switch from the user you created during
+    installation to the ``root`` user.
 
 Apply Updates
 _____________
@@ -410,46 +430,42 @@ Create a new key and allow anyone with that key to log in:
 
    .. code-block:: console
 
-        [root@pcmk-1 ~]# ssh-keygen -f ~/.ssh/id_rsa -N ""
-        Generating public/private rsa key pair.
-        Your identification has been saved in /root/.ssh/id_rsa
-        Your public key has been saved in /root/.ssh/id_rsa.pub
+        [root@pcmk-1 ~]# ssh-keygen -f ~/.ssh/id_ed25519 -N ""
+        Generating public/private ed25519 key pair.
+        Your identification has been saved in /root/.ssh/id_ed25519
+        Your public key has been saved in /root/.ssh/id_ed25519.pub
         The key fingerprint is:
-        SHA256:h5AFPmXsGU4woOxRLYHW9lnU2wIQVOxpSRrsXbo/AX8 root@pcmk-1
+        SHA256:BhlHJU3REGOpO0FA7Mqvp60WaB/2unQOZki+0mZKfee8 root@pcmk-1
         The key's randomart image is:
-        +---[RSA 3072]----+
-        |   o+*BX*.       |
-        | .oo+.+*O o      |
-        | .+. +=% O o     |
-        | . .  =o%.o .    |
-        |  .    .S+..     |
-        |        ..o E    |
-        |         . o     |
-        |          o      |
-        |           .     |
-        +----[SHA256]-----+
-
-        [root@pcmk-1 ~]# cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
-
-Install the key on the other node:
-
-.. code-block:: console
-
-    [root@pcmk-1 ~]# ssh-copy-id pcmk-2
-    /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
-    The authenticity of host 'pcmk-2 (192.168.122.102)' can't be established.
-    ED25519 key fingerprint is SHA256:QkJnJ3fmszY7kAuuZ7wxUC5CC+eQThSCF13XYWnZJPo.
-    This host key is known by the following other names/addresses:
-        ~/.ssh/known_hosts:1: 192.168.122.102
-    Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
-    /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
-    /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
-    root@pcmk-2's password:
-
-    Number of key(s) added: 1
-
-    Now try logging into the machine, with:   "ssh 'pcmk-2'"
-    and check to make sure that only the key(s) you wanted were added.
+        +--[ED255219 256]--+
+        |     .o=++=+      |
+        |      o.*..       |
+        |     + B          |
+        |    . * o         |
+        |   ..+oo S        |
+        |   +B++ .         |
+        |  o=*o.o          |
+        |o.==oo..          |
+        | +B+.+E.          |
+        +----[SHA256]------+
+
+        [root@pcmk-1 ~]# cat ~/.ssh/id_25519.pub >> ~/.ssh/authorized_keys
+        [root@pcmk-1 ~]# chmod 600 ~/.ssh/authorized_keys
+
+Install the key on the other node.  Because you can't login as root on the
+console or over SSH yet (that's what we're setting up now), the easiest way
+to do this is as follows:
+
+#. SSH into both nodes as the regular user.
+#. Use ``sudo`` to become ``root`` on each node.
+#. On ``pcmk-1``, cat the ``/root/.ssh/id_ed25519`` file and copy its contents
+   with the mouse.
+#. On ``pcmk-2``, paste those contents into ``/root/.ssh/id_ed25519``.
+#. ``chmod 600 /root/.ssh/id_ed25519``.
+#. On ``pcmk-1``, cat the ``/root/.ssh/id_25519.pub`` file and copy its
+   contents with the mouse.
+#. On ``pcmk-2``, paste those contents into ``/root/.ssh/authorized_keys``.
+#. ``chmod 600 /root/.ssh/authorized_keys``
 
 Test that you can now run commands remotely, without being prompted:
 
@@ -458,9 +474,8 @@ Test that you can now run commands remotely, without being prompted:
     [root@pcmk-1 ~]# ssh pcmk-2 -- uname -n
     pcmk-2
 
-Finally, repeat this same process on the other node. For convenience, you can
-also generate an SSH key on your administrative machine and use ``ssh-copy-id``
-to copy it to both cluster nodes.
+It may also be handy to generate an SSH key on your administrative machine
+as your regular user and use ``ssh-copy-id`` to copy it to both cluster nodes.
 
 .. [#] You can also avoid this SPOF by specifying an ``addr`` option for each
        node when creating the cluster. We will discuss this in a later section.