Alex/kaido-core
SHA256
Watch
1
0
Fork
You've already forked kaido-core
 0
Code Issues 11 Pull requests 1 Releases Activity Actions

VRRP without an HA cluster fences DHCP and blocks the API after restart #81

New issue
Open
opened 2026-11-08 11:04:21 +01:00 by Alex · 0 comments
Alex commented 2026-11-08 11:04:21 +01:00
Owner

Problem

  • With router.ha.vrrp but no cluster/peer, and an active DHCP server, the keepalived hook sets the persistent ha-role fence on BACKUP and disables Kea with dhcp-disable.
  • Without a cluster nothing clears that fence.

Impact

  • DHCP stops on that node.
  • At the next agent start DHCP adoption fails with allocator is fenced, and the API stays at 503 (HA management hold requires committed HA configuration).
  • The e2e TOML ha-ipsec profile produces no export for this reason.

Proposed change

  • Reject VRRP without a cluster next to DHCP pools in validation until the intended behaviour is decided.
  • Alternatives to weigh: no DHCP fence without a cluster, or serving DHCP only while MASTER.

Validation

  • Validation tests for the rejected combination and for VRRP without DHCP.
  • tests/e2e/toml ha-ipsec profile adjusted so that it reaches an export.
## Problem - With `router.ha.vrrp` but no `cluster`/`peer`, and an active DHCP server, the keepalived hook sets the persistent `ha-role` fence on BACKUP and disables Kea with `dhcp-disable`. - Without a cluster nothing clears that fence. ## Impact - DHCP stops on that node. - At the next agent start DHCP adoption fails with `allocator is fenced`, and the API stays at 503 (`HA management hold requires committed HA configuration`). - The e2e TOML `ha-ipsec` profile produces no export for this reason. ## Proposed change - Reject VRRP without a cluster next to DHCP pools in validation until the intended behaviour is decided. - Alternatives to weigh: no DHCP fence without a cluster, or serving DHCP only while MASTER. ## Validation - Validation tests for the rejected combination and for VRRP without DHCP. - `tests/e2e/toml` `ha-ipsec` profile adjusted so that it reaches an export.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
134-reply-to-before-routing
119-example-firstboot
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Alex/kaido-core#81
No description provided.