Setting up two-node Db2 HADR Pacemaker cluster with fencing on Google Cloud

Download Access Key File.

The Key file is used to authenticate the service account in the Google Cloud backend. The file must be downloaded to both nodes in the cluster and is used as an optional argument when the fencing agent in the pacemaker cluster is configured. You can use the gcloud command either in the Google Cloud Console or on one of the virtual machines in the cluster directly.

If you use the command in the Google Cloud Console, you can store the Key File locally on your workstation and upload it to the virtual machines afterward.

A more convenient way is to execute the gcloud command on one of the nodes in the cluster, save the Key File immediately on this node and copy it to the second node. The Key File can be located in the directory “fence_auth” in the home directory of the Db2 instance owner. To prepare the directory structure, perform the following command sequence on both nodes in the cluster.

If the setup in your organization requires a different setup for the key management, refer to:

Best practices for managing service account keys  |  IAM Documentation  |  Google Cloud

Secret Manager  |  Google Cloud

The following example shows how to execute the cloud command on the virtual machines itself.

To store the key file, create a new directory, for example /etc/db2pcmk_fence as user root on both nodes in the cluster.

mkdir /etc/db2pcmk_fence
chmod 700 /etc/db2pcmk_fence
cd /etc/db2pcmk_fence

In Cloud Shell. Generate and download the access key file for the service account used for the fencing agent.

Note: This command must be executed only on one of the virtual machines. In our case, we use the primary database server pcmkdb01. 
The following example shows how to execute the cloud command on the virtual machines itself.

gcloud iam service-accounts keys create db2gp1.json --iam-account=db2gp1-service-account@db2pcmk2023.iam.gserviceaccount.com 

Once this file is downloaded to the virtual machine, copy the file to the second node and change the permissions. 
 

scp db2gp1.json pcmkdb02:/etc/db2pcmk_fence
ssh pcmkdb02 "chmod 700 /etc/db2pcmk_fence/db2gp1.json"

6. Prepare the Cluster for Fencing

        [Service]
        ExecStartPre=/bin/sleep 60

       Quorum { 
             provider: corosync_votequorum 
             two_node: 1
            wait_for_all: 1 
        } 

-    Increase the value for token from 10.000 to 20.000 in the /etc/corosync/corosync.conf file on both hosts: 
 

		totem {
		    version: 2
		    cluster_name: GP1cluster
		    transport: knet
		    token: 20000
		    crypto_cipher: aes256
		    crypto_hash: sha256
		}

-    Start the Pacemaker cluster on both hosts: crm cluster start 
-    Enable the fencing-related properties: 

crm  configure property stonith-enabled=true 
crm configure property no-quorum-policy=stop
crm configure property priority-fencing-delay=60

crm configure primitive fence_db2_gcp_db2gp1 stonith:fence_gce 
op monitor interval=300s timeout=120s
op start interval=0 timeout=60s
params serviceaccount="/etc/db2pcmk_fence/db2gp1.json"
pcmk_host_list="pcmkdb01,pcmkdb02" zone=europe-west1-b project=db2pcmk2023
pcmk_reboot_timeout=300 
pcmk_monitor_retries=4 
pcmk_delay_max=30
meta is-managed=true 

crm configure manage fence_db2_gcp_db2gp1