question about a master node crash in a pool.

[oliv77]

Hi,

We are currently using an XCP-ng pool with an XOA (Xen Orchestra) instance hosted within the same pool.

Recently, we encountered a crash of the Master node. At that precise moment, we had disabled High Availability (HA) for specific maintenance on the pool that had been performed a few days prior .
Although the XOA VM remained operational on a Slave node, we found ourselves in a "blind management" situation: the XOA interface could no longer communicate with the pool because the XAPI entry point (the Master) was down.

To avoid this scenario in the future, I would appreciate your opinion on the feasibility and best practices regarding the following points:
Out-of-band management: Is it recommended to move XOA to a physical server (or a management pool) completely independent of the production pool it manages to ensure visibility in case of quorum loss?

Cross-Configuration: If we have two separate pools (Pool A and Pool B), is it advisable to host XOA-A on Pool B to manage Pool A, and vice versa?
High Availability (HA) Behavior: Even with HA enabled, while the system elects a new Master and the XAPI stack restarts, will there always be a period of unavailability for the XOA interface?
We are looking to ensure that our management tools remain available and "visible" even in the event of a critical Master failure.

Thank you in advance for your advice and for all the work done on XCP-ng.

Best regards
Olivier

[olivierlambert]

Hi,

In that case, the easiest thing to do is:

1. wait for the master to get back
2. or if it won't come back, to elect a slave as the new master (one CLI command to run and you are done)

It's very straightforward. It shouldn't be a dreaded scenario, because as soon as you lose management, you know it and it doesn't impact the rest of your VMs. Even without HA, it's a pretty easy situation to solve.

Note it shouldn't happen that often, as long as you have a documented procedure, it should be enough to deal with it.