Procedure

1. Convert the image from qcow2 to raw format.

   $ qemu-img convert -f qcow2 -O raw <image-name>.qcow2 <image-name>.raw

2. Create a shell script using the contents below.

   #!/bin/bash
   MB=$((1024 * 1024))
   size=$(qemu-img info -f raw --output json "$1" | gawk 'match($0, /"virtual-size": ([0-9]+),/, val) {print val[1]}')
   rounded_size=$((($size/$MB + 1) * $MB))
   if [ $(($size % $MB)) -eq  0 ]
   then
    echo "Your image is already aligned. You do not need to resize."
    exit 1
   fi
   echo "rounded size = $rounded_size"
   export rounded_size

3. Run the script. This example uses the name align.sh.

   $ sh align.sh <image-xxx>.raw

   • If the message "Your image is already aligned. You do not need to resize." displays, proceed to the following step.
   • If a value displays, your image is not aligned. Resize the image using the procedures in the Aligning the image section before proceeding to the next step.

4. Use the following command to convert the file to a fixed VHD format.

   The sample uses qemu-img version 2.12.0.

   $ qemu-img convert -f raw -o subformat=fixed,force_size -O vpc <image-xxx>.raw <image.xxx>.vhd

   Once converted, the VHD file is ready to upload to Azure.

1. Resize the raw file using the rounded value displayed when you ran the verification script.

   $ qemu-img resize -f raw <image-xxx>.raw <rounded-value>

2. Convert the raw image file to a VHD format.

   The sample uses qemu-img version 2.12.0.

   $ qemu-img convert -f raw -o subformat=fixed,force_size -O vpc <image-xxx>.raw <image.xxx>.vhd

   Once converted, the VHD file is ready to upload to Azure.

Procedure

1. Import the Microsoft repository key.

   $ sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc

2. Create a local Azure CLI repository entry.

   $ sudo sh -c 'echo -e "[azure-cli]\nname=Azure CLI\nbaseurl=https://packages.microsoft.com/yumrepos/azure-cli\nenabled=1\ngpgcheck=1\ngpgkey=https://packages.microsoft.com/keys/microsoft.asc" > /etc/yum.repos.d/azure-cli.repo'

3. Update the yum package index.

   $ yum check-update

4. Check your Python version (python --version) and install Python 3.x, if necessary.

   $ sudo yum install python3

5. Install the Azure CLI.

   $ sudo yum install -y azure-cli

6. Run the Azure CLI.

   $ az

Procedure

1. Enter the following command to authenticate your system with Azure and log in.

   $ az login

   Note

   If a browser is available in your environment, the CLI opens your browser to the Azure sign-in page. See Sign in with Azure CLI for more information and options.

2. Create a resource group in an Azure region.

   $ az group create --name <resource-group> --location <azure-region>

   Example:

   $ az group create --name azrhelclirsgrp --location southcentralus
   {
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp",
     "location": "southcentralus",
     "managedBy": null,
     "name": "azrhelclirsgrp",
     "properties": {
       "provisioningState": "Succeeded"
     },
     "tags": null
   }

3. Create a storage account. See SKU Types for more information about valid SKU values.

   $ az storage account create -l <azure-region> -n <storage-account-name> -g <resource-group> --sku <sku_type>

   Example:

   $ az storage account create -l southcentralus -n azrhelclistact -g azrhelclirsgrp --sku Standard_LRS
   {
     "accessTier": null,
     "creationTime": "2017-04-05T19:10:29.855470+00:00",
     "customDomain": null,
     "encryption": null,
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Storage/storageAccounts/azrhelclistact",
     "kind": "StorageV2",
     "lastGeoFailoverTime": null,
     "location": "southcentralus",
     "name": "azrhelclistact",
     "primaryEndpoints": {
       "blob": "https://azrhelclistact.blob.core.windows.net/",
       "file": "https://azrhelclistact.file.core.windows.net/",
       "queue": "https://azrhelclistact.queue.core.windows.net/",
       "table": "https://azrhelclistact.table.core.windows.net/"
   },
   "primaryLocation": "southcentralus",
   "provisioningState": "Succeeded",
   "resourceGroup": "azrhelclirsgrp",
   "secondaryEndpoints": null,
   "secondaryLocation": null,
   "sku": {
     "name": "Standard_LRS",
     "tier": "Standard"
   },
   "statusOfPrimary": "available",
   "statusOfSecondary": null,
   "tags": {},
     "type": "Microsoft.Storage/storageAccounts"
   }

4. Get the storage account connection string.

   $ az storage account show-connection-string -n <storage-account-name> -g <resource-group>

   Example:

   [clouduser@localhost]$ az storage account show-connection-string -n azrhelclistact -g azrhelclirsgrp
   {
     "connectionString": "DefaultEndpointsProtocol=https;EndpointSuffix=core.windows.net;AccountName=azrhelclistact;AccountKey=NreGk...=="
   }

5. Export the connection string by copying the connection string and pasting it into the following command. This string connects your system to the storage account.

   $ export AZURE_STORAGE_CONNECTION_STRING="<storage-connection-string>"

   Example:

   [clouduser@localhost]$ export AZURE_STORAGE_CONNECTION_STRING="DefaultEndpointsProtocol=https;EndpointSuffix=core.windows.net;AccountName=azrhelclistact;AccountKey=NreGk...=="

6. Create the storage container.

   $ az storage container create -n <container-name>

   Example:

   [clouduser@localhost]$ az storage container create -n azrhelclistcont
   {
     "created": true
   }

7. Create a virtual network.

   $ az network vnet create -g <resource group> --name <vnet-name> --subnet-name <subnet-name>

   Example:

   [clouduser@localhost]$ az network vnet create --resource-group azrhelclirsgrp --name azrhelclivnet1 --subnet-name azrhelclisubnet1
   {
     "newVNet": {
       "addressSpace": {
         "addressPrefixes": [
         "10.0.0.0/16"
         ]
     },
     "dhcpOptions": {
       "dnsServers": []
     },
     "etag": "W/\"\"",
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Network/virtualNetworks/azrhelclivnet1",
     "location": "southcentralus",
     "name": "azrhelclivnet1",
     "provisioningState": "Succeeded",
     "resourceGroup": "azrhelclirsgrp",
     "resourceGuid": "0f25efee-e2a6-4abe-a4e9-817061ee1e79",
     "subnets": [
       {
         "addressPrefix": "10.0.0.0/24",
         "etag": "W/\"\"",
         "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Network/virtualNetworks/azrhelclivnet1/subnets/azrhelclisubnet1",
         "ipConfigurations": null,
         "name": "azrhelclisubnet1",
         "networkSecurityGroup": null,
         "provisioningState": "Succeeded",
         "resourceGroup": "azrhelclirsgrp",
         "resourceNavigationLinks": null,
         "routeTable": null
       }
     ],
     "tags": {},
     "type": "Microsoft.Network/virtualNetworks",
     "virtualNetworkPeerings": null
     }
   }

Procedure

1. Upload the VHD file to the storage container; it may take several minutes. To get a list of storage containers, enter the az storage container list command.

   $ az storage blob upload --account-name <storage-account-name> --container-name <container-name> --type page --file <path-to-vhd> --name <image-name>.vhd

   Example:

   $ az storage blob upload --account-name azrhelclistact --container-name azrhelclistcont --type page --file rhel-image-7.vhd --name rhel-image-7.vhd
   Percent complete: %100.0

2. Get the URL for the uploaded VHD file to use in the following step.

   $ az storage blob url -c <container-name> -n <image-name>.vhd

   Example:

   $ az storage blob url -c azrhelclistcont -n rhel-image-7.vhd
   "https://azrhelclistact.blob.core.windows.net/azrhelclistcont/rhel-image-7.vhd"

3. Create the Azure custom image.

   $ az image create -n <image-name> -g <resource-group> -l <azure-region> --source <URL> --os-type linux

   Note

   The default hypervisor generation of the VM is V1. You can optionally specify a V2 hypervisor generation by including the option --hyper-v-generation V2. Generation 2 VMs use a UEFI-based boot architecture. See Support for generation 2 VMs on Azure for information on generation 2 VMs.

   The command may return the error "Only blobs formatted as VHDs can be imported." This error may mean that the image was not aligned to the nearest 1 MB boundary before it was converted to VHD.

   Example:

   $ az image create -n rhel7 -g azrhelclirsgrp2 -l southcentralus --source https://azrhelclistact.blob.core.windows.net/azrhelclistcont/rhel-image-7.vhd --os-type linux

Procedure

1. Enter the following command to create the VM.

   $ az vm create -g <resource-group> -l <azure-region> -n <vm-name> --vnet-name <vnet-name> --subnet <subnet-name> --size Standard_A2 --os-disk-name <simple-name> --admin-username <administrator-name> --generate-ssh-keys --image <path-to-image>

   Note

   The option --generate-ssh-keys creates a private/public key pair. Private and public key files are created in ~/.ssh on your system. The public key is added to the authorized_keys file on the VM for the user specified by the --admin-username option. See Other authentication methods for additional information.

   Example:

   [clouduser@localhost]$ az vm create -g azrhelclirsgrp2 -l southcentralus -n rhel-azure-vm-1 --vnet-name azrhelclivnet1 --subnet azrhelclisubnet1  --size Standard_A2 --os-disk-name vm-1-osdisk --admin-username clouduser --generate-ssh-keys --image rhel7
   {
     "fqdns": "",
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Compute/virtualMachines/rhel-azure-vm-1",
     "location": "southcentralus",
     "macAddress": "",
     "powerState": "VM running",
     "privateIpAddress": "10.0.0.4",
     "publicIpAddress": "<public-IP-address>",
     "resourceGroup": "azrhelclirsgrp2"

2. Start an SSH session and log in to the VM.

   [clouduser@localhost]$ ssh  -i /home/clouduser/.ssh/id_rsa clouduser@<public-IP-address>.
   The authenticity of host,  '<public-IP-address>' can't be established.
   Are you sure you want to continue connecting (yes/no)? yes
   Warning: Permanently added '<public-IP-address>' (ECDSA) to the list of known hosts.

Procedure

1. Register your system.

   subscription-manager register --auto-attach

2. Attach your subscriptions.

   • You can use an activation key to attach subscriptions. Refer to Creating Red Hat Customer Portal Activation Keys.
   • Alternatively, you can manually attach a subscription using the ID of the subscription pool (Pool ID). Refer to Attaching and Removing Subscriptions Through the Command Line.

Procedure

1. Ensure you are an Administrator or Owner for the Microsoft Azure subscription. You need this authorization to create an Azure AD application.

2. Log in to your Azure account.

   $ az login

3. Enter the following command to create the Azure AD Application. To use your own password, add the --password option to the command. Ensure that you create a strong password.

   $ az ad sp create-for-rbac --name _FencingApplicationName_ --role owner --scopes "/subscriptions/_SubscriptionID_/resourceGroups/_MyResourseGroup_"

   Example:

   [clouduser@localhost ~] $ az ad sp create-for-rbac --name FencingApp --role owner --scopes "/subscriptions/2586c64b-xxxxxx-xxxxxxx-xxxxxxx/resourceGroups/azrhelclirsgrp"
   Retrying role assignment creation: 1/36
   Retrying role assignment creation: 2/36
   Retrying role assignment creation: 3/36
   {
     "appId": "1a3dfe06-df55-42ad-937b-326d1c211739",
     "displayName": "FencingApp",
     "name": "http://FencingApp",
     "password": "43a603f0-64bb-482e-800d-402efe5f3d47",
     "tenant": "77ecefb6-xxxxxxxxxx-xxxxxxx-757a69cb9485"
   }

4. Save the following information before proceeding. You need this information to set up the fencing agent.

   • Azure AD Application ID
   • Azure AD Application Password
   • Tenant ID
   • Microsoft Azure Subscription ID

Procedure

1. Register the VM with Red Hat.

   $ sudo -i
   # subscription-manager register --auto-attach

2. Disable all repositories.

   # subscription-manager repos --disable=*

3. Enable the RHEL 7 Server and RHEL 7 Server HA repositories.

   # subscription-manager repos --enable=rhel-7-server-rpms
   # subscription-manager repos --enable=rhel-ha-for-rhel-7-server-rpms

4. Update all packages.

   # yum update -y

5. Reboot if the kernel is updated.

   # reboot

6. Install pcs, pacemaker, fence agent, resource agent, and nmap-ncat.

   # yum install -y pcs pacemaker fence-agents-azure-arm resource-agents nmap-ncat

Procedure

1. The user hacluster was created during the pcs and pacemaker installation in the previous section. Create a password for hacluster on all cluster nodes. Use the same password for all nodes.

   # passwd hacluster

2. Add the high availability service to the RHEL Firewall if firewalld.service is enabled.

   # firewall-cmd --permanent --add-service=high-availability
   # firewall-cmd --reload

3. Start the pcs service and enable it to start on boot.

   # systemctl enable pcsd.service --now

Procedure

1. On one of the nodes, enter the following command to authenticate the pcs user hacluster. Specify the name of each node in the cluster.

   # pcs host auth  _hostname1_ _hostname2_ _hostname3_

   Example:

   [root@node01 clouduser]# pcs host auth node01 node02 node03
   Username: hacluster
   Password:
   node01: Authorized
   node02: Authorized
   node03: Authorized

2. Create the cluster.

   # pcs cluster setup --name _hostname1_ _hostname2_ _hostname3_

   Example:

   [root@node01 clouduser]# pcs cluster setup --name newcluster node01 node02 node03
   
   ...omitted
   
   Synchronizing pcsd certificates on nodes node01, node02, node03...
   node02: Success
   node03: Success
   node01: Success
   Restarting pcsd on the nodes in order to reload the certificates...
   node02: Success
   node03: Success
   node01: Success

Verification steps

1. Enable the cluster.

   # pcs cluster enable --all

2. Start the cluster.

   # pcs cluster start --all

   Example:

   [root@node01 clouduser]# pcs cluster enable --all
   node02: Cluster Enabled
   node03: Cluster Enabled
   node01: Cluster Enabled
   
   [root@node01 clouduser]# pcs cluster start --all
   node02: Starting Cluster...
   node03: Starting Cluster...
   node01: Starting Cluster...

Procedure

1. Identify the available instances that can be fenced.

   # fence_azure_arm -l [appid] -p [authkey] --resourceGroup=[name] --subscriptionId=[name] --tenantId=[name] -o list

   Example:

   [root@node1 ~]# fence_azure_arm -l XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX -p XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX --resourceGroup=hacluster-rg --subscriptionId=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX --tenantId=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX -o list
   node01-vm,
   node02-vm,
   node03-vm,

2. Create a fence device. Use the pcmk_host_map command to map the RHEL host name to the instance ID.

   # pcs stonith create _clusterfence_ fence_azure_arm login=_AD-Application-ID_ passwd=_AD-passwd_ pcmk_host_map="_pcmk-host-map_ resourcegroup= _myresourcegroup_ tenantid=_tenantid_ subscriptionid=_subscriptionid_

Verification steps

1. Test the fencing agent for one of the other nodes.

   # pcs stonith fence _azurenodename_

   Example:

   [root@node01 ~]# pcs stonith fence fenceazure
    Resource: fenceazure (class=stonith type=fence_azure_arm)
     Attributes: login=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX passwd=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX pcmk_host_map=nodea:nodea-vm;nodeb:nodeb-vm;nodec:nodec-vm pcmk_reboot_retries=4 pcmk_reboot_timeout=480 power_timeout=240 resourceGroup=rg subscriptionId=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX tenantId=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
     Operations: monitor interval=60s (fenceazure-monitor-interval-60s)
   [root@node01 ~]# pcs stonith
    fenceazure     (stonith:fence_azure_arm):      Started nodea

2. Check the status to verify the node started.

   # watch pcs status

   Example:

   [root@node01 ~]# watch pcs status
    fenceazure     (stonith:fence_azure_arm):      Started nodea

Procedure

1. Create a basic load balancer. Select Internal load balancer, the Basic SKU, and Dynamic for the type of IP address assignment.
2. Create a backend address pool. Associate the backend pool to the availability set created while creating Azure resources in HA. Do not set any target network IP configurations.
3. Create a health probe. For the health probe, select TCP and enter port 61000. You can use a TCP port number that does not interfere with another service. For certain HA product applications, for example, SAP HANA and SQL Server, you may need to work with Microsoft to identify the correct port to use.
4. Create a load balancer rule. To create the load balancing rule, use the default values that are prepopulated. Ensure to set Floating IP (direct server return) to Enabled.

Procedure

1. Enter the Azure id command to view the Azure load balancer resource agent description. This shows the options and default operations for this agent.

   # pcs resource describe _azure-id_

2. Create an Ipaddr2 resource for managing the IP on the node.

   # pcs resource create _resource-id_ IPaddr2 ip=_virtual/floating-ip_ cidr_netmask=_virtual/floating-mask_ --group _group-id_ nic=_network-interface_ op monitor interval=30s

   Example:

   [root@node01 ~]# pcs resource create ClusterIP ocf:heartbeat:IPaddr2 ip=172.16.66.99 cidr_netmask=24 --group CloudIP nic=eth0 op monitor interval=30s

3. Configure the load balancer resource agent.

   # pcs resource create _resource-loadbalancer-name_ azure-lb port=_port-number_ --group _cluster-resources-group_

Procedure

1. Create a shared block volume using the Azure command az disk create.

   $ az disk create -g resource_group -n shared_block_volume_name --size-gb disk_size --max-shares number_vms -l location

   For example, the following command creates a shared block volume named shared-block-volume.vhd in the resource group sharedblock within the Azure Availability Zone westcentralus.

   $ az disk create -g sharedblock-rg -n shared-block-volume.vhd --size-gb 1024 --max-shares 3 -l westcentralus
   
   {
     "creationData": {
       "createOption": "Empty",
       "galleryImageReference": null,
       "imageReference": null,
       "sourceResourceId": null,
       "sourceUniqueId": null,
       "sourceUri": null,
       "storageAccountId": null,
       "uploadSizeBytes": null
     },
     "diskAccessId": null,
     "diskIopsReadOnly": null,
     "diskIopsReadWrite": 5000,
     "diskMbpsReadOnly": null,
     "diskMbpsReadWrite": 200,
     "diskSizeBytes": 1099511627776,
     "diskSizeGb": 1024,
     "diskState": "Unattached",
     "encryption": {
       "diskEncryptionSetId": null,
       "type": "EncryptionAtRestWithPlatformKey"
     },
     "encryptionSettingsCollection": null,
     "hyperVgeneration": "V1",
     "id": "/subscriptions/12345678910-12345678910/resourceGroups/sharedblock-rg/providers/Microsoft.Compute/disks/shared-block-volume.vhd",
     "location": "westcentralus",
     "managedBy": null,
     "managedByExtended": null,
     "maxShares": 3,
     "name": "shared-block-volume.vhd",
     "networkAccessPolicy": "AllowAll",
     "osType": null,
     "provisioningState": "Succeeded",
     "resourceGroup": "sharedblock-rg",
     "shareInfo": null,
     "sku": {
       "name": "Premium_LRS",
       "tier": "Premium"
     },
     "tags": {},
     "timeCreated": "2020-08-27T15:36:56.263382+00:00",
     "type": "Microsoft.Compute/disks",
     "uniqueId": "cd8b0a25-6fbe-4779-9312-8d9cbb89b6f2",
     "zones": null
   }

2. Verify that you have created the shared block volume using the Azure command az disk show.

   $ az disk show -g resource_group -n shared_block_volume_name

   For example, the following command shows details for the shared block volume shared-block-volume.vhd within the resource group sharedblock-rg.

   $ az disk show -g sharedblock-rg -n shared-block-volume.vhd
   
   {
     "creationData": {
       "createOption": "Empty",
       "galleryImageReference": null,
       "imageReference": null,
       "sourceResourceId": null,
       "sourceUniqueId": null,
       "sourceUri": null,
       "storageAccountId": null,
       "uploadSizeBytes": null
     },
     "diskAccessId": null,
     "diskIopsReadOnly": null,
     "diskIopsReadWrite": 5000,
     "diskMbpsReadOnly": null,
     "diskMbpsReadWrite": 200,
     "diskSizeBytes": 1099511627776,
     "diskSizeGb": 1024,
     "diskState": "Unattached",
     "encryption": {
       "diskEncryptionSetId": null,
       "type": "EncryptionAtRestWithPlatformKey"
     },
     "encryptionSettingsCollection": null,
     "hyperVgeneration": "V1",
     "id": "/subscriptions/12345678910-12345678910/resourceGroups/sharedblock-rg/providers/Microsoft.Compute/disks/shared-block-volume.vhd",
     "location": "westcentralus",
     "managedBy": null,
     "managedByExtended": null,
     "maxShares": 3,
     "name": "shared-block-volume.vhd",
     "networkAccessPolicy": "AllowAll",
     "osType": null,
     "provisioningState": "Succeeded",
     "resourceGroup": "sharedblock-rg",
     "shareInfo": null,
     "sku": {
       "name": "Premium_LRS",
       "tier": "Premium"
     },
     "tags": {},
     "timeCreated": "2020-08-27T15:36:56.263382+00:00",
     "type": "Microsoft.Compute/disks",
     "uniqueId": "cd8b0a25-6fbe-4779-9312-8d9cbb89b6f2",
     "zones": null
   }

3. Create three network interfaces using the Azure command az network nic create. Run the following command three times using a different <nic_name> for each.

   $ az network nic create -g resource_group -n nic_name --subnet subnet_name --vnet-name virtual_network --location location --network-security-group network_security_group --private-ip-address-version IPv4

   For example, the following command creates a network interface with the name shareblock-nodea-vm-nic-protected.

   $ az network nic create -g sharedblock-rg -n sharedblock-nodea-vm-nic-protected --subnet sharedblock-subnet-protected --vnet-name sharedblock-vn --location westcentralus --network-security-group sharedblock-nsg --private-ip-address-version IPv4

4. Create three virtual machines and attach the shared block volume using the Azure command az vm create. Option values are the same for each VM except that each VM has its own <vm_name>, <new_vm_disk_name>, and <nic_name>.

   $ az vm create -n vm_name -g resource_group --attach-data-disks shared_block_volume_name --data-disk-caching None --os-disk-caching ReadWrite --os-disk-name new-vm-disk-name --os-disk-size-gb disk_size --location location --size virtual_machine_size --image image_name --admin-username vm_username --authentication-type ssh --ssh-key-values ssh_key --nics -nic_name_ --availability-set availability_set --ppg proximity_placement_group

   For example, the following command creates a virtual machine named sharedblock-nodea-vm.

   $ az vm create -n sharedblock-nodea-vm -g sharedblock-rg --attach-data-disks shared-block-volume.vhd --data-disk-caching None --os-disk-caching ReadWrite --os-disk-name sharedblock-nodea-vm.vhd --os-disk-size-gb 64 --location westcentralus --size Standard_D2s_v3 --image /subscriptions/12345678910-12345678910/resourceGroups/sample-azureimagesgroupwestcentralus/providers/Microsoft.Compute/images/sample-azure-rhel-7.0-20200713.n.0.x86_64 --admin-username sharedblock-user --authentication-type ssh --ssh-key-values @sharedblock-key.pub --nics sharedblock-nodea-vm-nic-protected --availability-set sharedblock-as --ppg sharedblock-ppg
   
   {
     "fqdns": "",
     "id": "/subscriptions/12345678910-12345678910/resourceGroups/sharedblock-rg/providers/Microsoft.Compute/virtualMachines/sharedblock-nodea-vm",
     "location": "westcentralus",
     "macAddress": "00-22-48-5D-EE-FB",
     "powerState": "VM running",
     "privateIpAddress": "198.51.100.3",
     "publicIpAddress": "",
     "resourceGroup": "sharedblock-rg",
     "zones": ""
   }

Verification steps

1. For each VM in your cluster, verify that the block device is available by using the SSH command with your VM <ip_address>.

   # ssh ip_address "hostname ; lsblk -d | grep ' 1T '"

   For example, the following command lists details including the host name and block device for the VM IP 198.51.100.3.

   # ssh 198.51.100.3 "hostname ; lsblk -d | grep ' 1T '"
   
   nodea
   sdb    8:16   0    1T  0 disk

2. Use the SSH command to verify that each VM in your cluster uses the same shared disk.

   # ssh _ip_address_s "hostname ; lsblk -d | grep ' 1T ' | awk '{print \$1}' | xargs -i udevadm info --query=all --name=/dev/{} | grep '^E: ID_SERIAL='"

   For example, the following command lists details including the host name and shared disk volume ID for the instance IP address 198.51.100.3.

   # ssh 198.51.100.3 "hostname ; lsblk -d | grep ' 1T ' | awk '{print \$1}' | xargs -i udevadm info --query=all --name=/dev/{} | grep '^E: ID_SERIAL='"
   
   nodea
   E: ID_SERIAL=3600224808dd8eb102f6ffc5822c41d89

Procedure

1. Install Python 3 and the pip tool.

   # yum install python3
   # yum install python3-pip

2. Install the AWS command line tools with the pip command.

   # pip3 install awscli

3. Run the aws --version command to verify that you installed the AWS CLI.

   $ aws --version
   aws-cli/1.16.182 Python/2.7.5 Linux/3.10.0-957.21.3.el7.x86_64 botocore/1.12.172

4. Configure the AWS command line client according to your AWS access details.

   $ aws configure
   AWS Access Key ID [None]:
   AWS Secret Access Key [None]:
   Default region name [None]:
   Default output format [None]:

Procedure

1. Launch the AWS Console.
2. Click on your AWS Account ID to display the drop-down menu and select My Security Credentials.
3. Click Users.
4. Select the user to open the Summary screen.
5. Click the Security credentials tab.
6. Click Create access key.
7. Download the .csv file (or save both keys). You need to enter these keys when creating the fencing device.

Procedure

1. Enter the following command to remove the AWS Red Hat Update Infrastructure (RHUI) client. Because you are going to use a Red Hat Cloud Access subscription, you should not use AWS RHUI in addition to your subscription.

   $ sudo -i
   # yum -y remove rh-amazon-rhui-client*

2. Register the VM with Red Hat.

   # subscription-manager register --auto-attach

3. Disable all repositories.

   # subscription-manager repos --disable=*

4. Enable the RHEL 7 Server and RHEL 7 Server HA repositories.

   # subscription-manager repos --enable=rhel-7-server-rpms
   # subscription-manager repos --enable=rhel-ha-for-rhel-7-server-rpms

5. Update all packages.

   # yum update -y

6. Reboot if the kernel is updated.

   # reboot

7. Install pcs, pacemaker, fence agent, and resource agent.

   # yum -y install pcs pacemaker fence-agents-aws resource-agents

8. The user hacluster was created during the pcs and pacemaker installation in the previous step. Create a password for hacluster on all cluster nodes. Use the same password for all nodes.

   # passwd hacluster

9. Add the high availability service to the RHEL Firewall if firewalld.service is enabled.

   # firewall-cmd --permanent --add-service=high-availability
   # firewall-cmd --reload

10. Start the pcs service and enable it to start on boot.

    # systemctl enable pcsd.service --now

Procedure

1. On one of the nodes, enter the following command to authenticate the pcs user hacluster. Specify the name of each node in the cluster.

   # pcs host auth  _hostname1_ _hostname2_ _hostname3_

   Example:

   [root@node01 clouduser]# pcs host auth node01 node02 node03
   Username: hacluster
   Password:
   node01: Authorized
   node02: Authorized
   node03: Authorized

2. Create the cluster.

   # pcs cluster setup --name _hostname1_ _hostname2_ _hostname3_

   Example:

   [root@node01 clouduser]# pcs cluster setup --name newcluster node01 node02 node03
   
   ...omitted
   
   Synchronizing pcsd certificates on nodes node01, node02, node03...
   node02: Success
   node03: Success
   node01: Success
   Restarting pcsd on the nodes in order to reload the certificates...
   node02: Success
   node03: Success
   node01: Success

Verification steps

1. Enable the cluster.

   # pcs cluster enable --all

2. Start the cluster.

   # pcs cluster start --all

   Example:

   [root@node01 clouduser]# pcs cluster enable --all
   node02: Cluster Enabled
   node03: Cluster Enabled
   node01: Cluster Enabled
   
   [root@node01 clouduser]# pcs cluster start --all
   node02: Starting Cluster...
   node03: Starting Cluster...
   node01: Starting Cluster...

Procedure

1. Enter the following AWS metadata query to get the Instance ID for each node. You need these IDs to configure the fence device. See Instance Metadata and User Data for additional information.

   # echo $(curl -s http://169.254.169.254/latest/meta-data/instance-id)

   Example:

   [root@ip-10-0-0-48 ~]# echo $(curl -s http://169.254.169.254/latest/meta-data/instance-id) i-07f1ac63af0ec0ac6

2. Create a fence device. Use the pcmk_host_map command to map the RHEL host name to the Instance ID. Use the AWS Access Key and AWS Secret Access Key you previously set up in Creating the AWS Access Key and AWS Secret Access Key.

   # pcs stonith create cluster_fence fence_aws access_key=access-key secret_key=_secret-access-key_ region=_region_ pcmk_host_map="rhel-hostname-1:Instance-ID-1;rhel-hostname-2:Instance-ID-2;rhel-hostname-3:Instance-ID-3"

   Example:

   [root@ip-10-0-0-48 ~]# pcs stonith create clusterfence fence_aws access_key=AKIAI*******6MRMJA secret_key=a75EYIG4RVL3h*******K7koQ8dzaDyn5yoIZ/ region=us-east-1 pcmk_host_map="ip-10-0-0-48:i-07f1ac63af0ec0ac6;ip-10-0-0-46:i-063fc5fe93b4167b2;ip-10-0-0-58:i-08bd39eb03a6fd2c7" power_timeout=240 pcmk_reboot_timeout=480 pcmk_reboot_retries=4

Verification steps

1. Test the fencing agent for one of the other nodes.

   # pcs stonith fence _awsnodename_

   Example:

   [root@ip-10-0-0-48 ~]# pcs stonith fence ip-10-0-0-58
   Node: ip-10-0-0-58 fenced

2. Check the status to verify that the node is fenced.

   # watch pcs status

   Example:

   [root@ip-10-0-0-48 ~]# pcs status
   Cluster name: newcluster
   Stack: corosync
   Current DC: ip-10-0-0-46 (version 1.1.18-11.el7-2b07d5c5a9) - partition with quorum
   Last updated: Fri Mar  2 20:01:31 2018
   Last change: Fri Mar  2 19:24:59 2018 by root via cibadmin on ip-10-0-0-48
   
   3 nodes configured
   1 resource configured
   
   Online: [ ip-10-0-0-46 ip-10-0-0-48 ip-10-0-0-58 ]
   
   Full list of resources:
   
     clusterfence  (stonith:fence_aws):    Started ip-10-0-0-46
   
   Daemon Status:
     corosync: active/disabled
     pacemaker: active/disabled
     pcsd: active/enabled

Procedure

1. Perform the procedure Installing the AWS CLI.

2. Enter the following command to verify that the AWS CLI is configured properly. The instance IDs and instance names should display.

   Example:

   [root@ip-10-0-0-48 ~]# aws ec2 describe-instances --output text --query 'Reservations[*].Instances[*].[InstanceId,Tags[?Key==`Name`].Value]'
   i-07f1ac63af0ec0ac6
   ip-10-0-0-48
   i-063fc5fe93b4167b2
   ip-10-0-0-46
   i-08bd39eb03a6fd2c7
   ip-10-0-0-58

Procedure

1. Enter the following command to view the AWS Secondary Private IP Address resource agent (awsvip) description. This shows the options and default operations for this agent.

   # pcs resource describe awsvip

2. Enter the following command to create the Secondary Private IP address using an unused private IP address in the VPC CIDR block.

   # pcs resource create privip awsvip secondary_private_ip=_Unused-IP-Address_ --group _group-name_

   Example:

   [root@ip-10-0-0-48 ~]# pcs resource create privip awsvip secondary_private_ip=10.0.0.68 --group networking-group

3. Create a virtual IP resource. This is a VPC IP address that can be rapidly remapped from the fenced node to the failover node, masking the failure of the fenced node within the subnet.

   # pcs resource create vip IPaddr2 ip=_secondary-private-IP_ --group _group-name_

   Example:

   root@ip-10-0-0-48 ~]# pcs resource create vip IPaddr2 ip=10.0.0.68 --group networking-group

1. Add the two resources to the same group that was previously created to enforce order and colocation constraints.

2. Enter the following AWS CLI command to create an elastic IP address.

   [root@ip-10-0-0-48 ~]# aws ec2 allocate-address --domain vpc --output text
   eipalloc-4c4a2c45   vpc 35.169.153.122

3. Enter the following command to view the AWS Secondary Elastic IP Address resource agent (awseip) description. This shows the options and default operations for this agent.

   # pcs resource describe awseip

4. Create the Secondary Elastic IP address resource using the allocated IP address created in Step 1.

   # pcs resource create elastic awseip elastic_ip=_Elastic-IP-Address_allocation_id=_Elastic-IP-Association-ID_ --group networking-group

   Example:

   # pcs resource create elastic awseip elastic_ip=35.169.153.122 allocation_id=eipalloc-4c4a2c45 --group networking-group

Procedure

1. Launch an SSH session from your local workstation to the elastic IP address previously created.

   $ ssh -l ec2-user -i ~/.ssh/<KeyName>.pem elastic-IP

   Example:

   $ ssh -l ec2-user -i ~/.ssh/cluster-admin.pem 35.169.153.122

2. Verify that the host you connected to via SSH is the host associated with the elastic resource created.

Procedure

1. Create a shared block volume using the AWS command create-volume.

   $ aws ec2 create-volume --availability-zone availability_zone --no-encrypted --size 1024 --volume-type io1 --iops 51200 --multi-attach-enabled

   For example, the following command creates a volume in the us-east-1a availability zone.

   $ aws ec2 create-volume --availability-zone us-east-1a --no-encrypted --size 1024 --volume-type io1 --iops 51200 --multi-attach-enabled
   
   {
       "AvailabilityZone": "us-east-1a",
       "CreateTime": "2020-08-27T19:16:42.000Z",
       "Encrypted": false,
       "Size": 1024,
       "SnapshotId": "",
       "State": "creating",
       "VolumeId": "vol-042a5652867304f09",
       "Iops": 51200,
       "Tags": [ ],
       "VolumeType": "io1"
   }

   Note

   You need the VolumeId in the next step.

2. For each instance in your cluster, attach a shared block volume using the AWS command attach-volume. Use your <instance_id> and <volume_id>.

   $ aws ec2 attach-volume --device /dev/xvdd --instance-id instance_id --volume-id volume_id

   For example, the following command attaches a shared block volume vol-042a5652867304f09 to instance i-0eb803361c2c887f2.

   $ aws ec2 attach-volume --device /dev/xvdd --instance-id i-0eb803361c2c887f2 --volume-id vol-042a5652867304f09
   
   {
       "AttachTime": "2020-08-27T19:26:16.086Z",
       "Device": "/dev/xvdd",
       "InstanceId": "i-0eb803361c2c887f2",
       "State": "attaching",
       "VolumeId": "vol-042a5652867304f09"
   }

Verification steps

1. For each instance in your cluster, verify that the block device is available by using the SSH command with your instance <ip_address>.

   # ssh <ip_address> "hostname ; lsblk -d | grep ' 1T '"

   For example, the following command lists details including the host name and block device for the instance IP 198.51.100.3.

   # ssh 198.51.100.3 "hostname ; lsblk -d | grep ' 1T '"
   
   nodea
   nvme2n1 259:1    0   1T  0 disk

2. Use the ssh command to verify that each instance in your cluster uses the same shared disk.

   # ssh ip_address "hostname ; lsblk -d | grep ' 1T ' | awk '{print \$1}' | xargs -i udevadm info --query=all --name=/dev/{} | grep '^E: ID_SERIAL='"

   For example, the following command lists details including the host name and shared disk volume ID for the instance IP address 198.51.100.3.

    # ssh 198.51.100.3 "hostname ; lsblk -d | grep ' 1T ' | awk '{print \$1}' | xargs -i udevadm info --query=all --name=/dev/{} | grep '^E: ID_SERIAL='"
   
   nodea
   E: ID_SERIAL=Amazon Elastic Block Store_vol0fa5342e7aedf09f7

Procedure

1. Disable all repositories.

   # subscription-manager repos --disable=*

2. Enable RHEL 7 server and RHEL 7 server HA repositories.

   # subscription-manager repos --enable=rhel-7-server-rpms
   # subscription-manager repos --enable=rhel-ha-for-rhel-7-server-rpms

3. Update all packages.

   # yum update -y

4. Install pcs pacemaker fence agent and resource agent.

   # yum install -y pcs pacemaker fence-agents-gce resource-agents-gcp

5. Reboot the machine if the kernel is updated.

   # reboot

Procedure

1. The user hacluster was created during the pcs and pacemaker installation in the previous step. Create a password for the user hacluster on all cluster nodes. Use the same password for all nodes.

   # passwd hacluster

2. If the firewalld service is enabled, add the high availability service to RHEL.

   # firewall-cmd --permanent --add-service=high-availability
   
   # firewall-cmd --reload

3. Start the pcs service and enable it to start on boot.

   # systemctl enable pcsd.service --now

Verification steps

1. Ensure the pcs service is running.

   # systemctl is-active pcsd.service

Procedure

1. On one of the nodes, enter the following command to authenticate the pcs user ha cluster. Specify the name of each node in the cluster.

   # pcs cluster auth  _hostname1_ _hostname2_ _hostname3_ -u hacluster

   Example:

   [root@node01 ~]# pcs cluster auth node01 node02 node03 -u hacluster
   node01: Authorized
   node02: Authorized
   node03: Authorized

2. Create the cluster.

   # pcs cluster setup --name cluster-name _hostname1_ _hostname2_  _hostname3_

Verification steps

1. Enable the cluster.

   # pcs cluster enable --all

2. Start the cluster.

   # pcs cluster start --all

Procedure

1. Get the GCP instance names from any node in the cluster. Note that the output also shows the internal ID for the instance.

   # fence_gce --zone _gcp_ _region_ --project= _gcp_ _project_ -o list

   Example:

   [root@rhel71-node-01 ~]# fence_gce --zone us-west1-b --project=rhel-ha-testing-on-gcp -o list
   44358**********3181,InstanceName-3
   40819**********6811,InstanceName-1
   71736**********3341,InstanceName-2

2. Create a fence device. Use the pcmk_host-name command to map the RHEL host name with the instance ID.

   # pcs stonith create _clusterfence_ fence_gce pcmk_host_map=_pcmk-hpst-map_ fence_gce zone=_gcp-zone_ project=_gcpproject_

   Example:

   [root@node01 ~]# pcs stonith create fencegce fence_gce pcmk_host_map="node01:node01-vm;node02:node02-vm;node03:node03-vm" project=hacluster zone=us-east1-b

Verification steps

1. Test the fencing agent for one of the other nodes.

   # pcs stonith fence gcp nodename

2. Check the status to verify that the node is fenced.

   # watch pcs status

1. Create the aliasip resource. Include an unused internal IP address. Include the CIDR block in the command.

   # pcs resource create aliasip gcp-vpc-move-vip  alias_ip=_UnusedIPaddress/CIDRblock_ --group _group-name_ --group _networking-group_

2. Create an IPaddr2 resource for managing the IP on the node.

   # pcs resource create vip IPaddr2 nic=_interface_ ip=_AliasIPaddress_ cidr_netmask=32 --group _group-name_ --group _networking-group_

3. Group the network resources under vipgrp.

   # pcs resource group add vipgrp aliasip vip

Verification steps

1. Verify that the resources have started and are grouped under vipgrp.

   # pcs status

2. Verify that the resource can move to a different node.

   # pcs resource move vip _Node_

   Example:

   # pcs resource move vip rhel71-node-03

3. Verify that the vip successfully started on a different node.

   # pcs status

Procedure

1. Create a secondary subnet address range.

   # gcloud-ra compute networks subnets update _SubnetName_ --region _RegionName_ --add-secondary-ranges _SecondarySubnetName_=_SecondarySubnetRange_

   Example:

   # gcloud-ra compute networks subnets update range0 --region us-west1 --add-secondary-ranges range1=10.10.20.0/24

2. Create the aliasip resource. Create an unused internal IP address in the secondary subnet address range. Include the CIDR block in the command.

   # pcs resource create aliasip gcp-vpc-move-vip alias_ip=_UnusedIPaddress/CIDRblock_ --group _group-name_ --group _networking-group_

3. Create an IPaddr2 resource for managing the IP on the node.

   # pcs resource create vip IPaddr2 nic=_interface_ ip=_AliasIPaddress_ cidr_netmask=32 --group _group-name_ --group _networking-group_

Verification steps

1. Verify that the resources have started and are grouped under vipgrp.

   # pcs status

2. Verify that the resource can move to a different node.

   # pcs resource move vip _Node_

   Example:

   [root@rhel71-node-01 ~]# pcs resource move vip rhel71-node-03

3. Verify that the vip successfully started on a different node.

   # pcs status