Difference between revisions of "Evacuate"

Revision as of 11:55, 1 August 2012

• Launchpad Entry: NovaSpec:rebuild-for-ha
• Created: 1 Aug 2012
• Contributors: Alex Glikson, Oshrit Feder, Pavel Kravchenco

Summary

High availability for VMs minimizes the effect of a nova-compute node failure. Upon failure detection, VMs whose storage is accessible from other nodes (e.g. shared storage) could be rebuilt and restarted on a target node

Release Note

Administrators detecting a compute node failure could evacuate the nodes' VMs to target nodes

Rationale

On commodity hardware, failures are common and should be considered to provide high service level. With VM HA support, administrators can evacuate VMs from a failed node, while keeping the VM characteristics such as identity, volumes, networks and state to ensure VM availability over time

User stories

• Administrator wants to evacuate and rebuild VMs from failed nodes

Assumptions

• VM to evacuate is down due to node failure, and is in started/powered off state
• VMs' storage is accessible from other nodes (e.g. shared storage), if not - rebuild is performed (re-create disk from image)
• The administrator selected a valid target node to rebuild the VM on
• Post evacuation and rebuild on target node, administrator responsible for any VM inconsistency that might occur during the sudden node failure (e.g. partial disk writes)

Recovery from compute node failure

With several changes, the existing rebuild instance functionality can be extended to support the HA scenario.

As when the administrator detects a compute node failure, all the VMs that were running on it are now down, the newly introduced evacuate REST API can be invoked to evacuate a selected VM to a specified running target compute node.

Evacuate is distinguished from rebuild with a dedicated admin api, as rebuild flushes the VM's disk and is intended to be used when it is desired to restart with reset disk through keep the identity. nova.compute.api exposes the evacuate method. When the target compute node receives the evacuation request, it invokes the modified rebuild method (nova.compute.rpcapi) with no image_ref and with with recreate flag set. Rebuild perform several additional tests when the recreate flag is set: 1. Makes sure that VM with the same name does not exists. 2. Validate shared storage (if instance's disk is not on shared storage, image_ref is updated with the image, and the process continue as pure rebuild). In addition, with the flag set, the is VM's record is updated with the new host, and as the VM is new on the host, only create is needed in contrast to destroy and re-create in the rebuild from image scenario. Next, the rebuild flow re-connects volumes and networks, state is ensured and the instance is spawned.

When/if the failed node is back online, further self cleanup is performed in compute.init_host (cleanup stale instances in virt and their network), to ensure that the recovered node is aware of the evacuated VMs and does not re-launch them. Evacuated VMs are being locked while evacuating to ensure single handler as the recovery of the failed node might happen while the evacuation is in progress (e.g. the VM has not yet rebuilt on the target node).

REST API

Admin API: v2/{tenant_id}/servers/{server_id}/action, with {server_id}=the server to evacuate, parameters: action=evacuate, host=target compute node to rebuild the server on

Code Changes

Code changes should include an overview of what needs to change, and in some cases even the specific details.

Related entries

http://wiki.openstack.org/Rebuildforvms

Test/Demo Plan

This need not be added or completed until the specification is nearing beta.

Unresolved issues

This should highlight any issues that should be addressed in further specifications, and not problems with the specification itself; since any specification with problems cannot be approved.

BoF agenda and discussion