Network & Infrastructure / High Availability & Recovery Design
Fencing must prove exclusion before shared-resource takeover
A cluster promotes a replacement node while the former owner is isolated but still running. Without reliable exclusion, both may write to a shared resource simultaneously.
Environment and inputs: Routed and clustered services; define failure ownership, fencing and application recovery requirements before testing. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Collect fencing requests, device responses, confirmation semantics, target identity and actual power or access state. Distinguish command acceptance from confirmed exclusion of the former owner.
Explain the result
A successful API response may only acknowledge a request. Safe takeover requires the cluster's supported fencing contract to establish that the old owner cannot continue conflicting access.
Plan the fix
Use tested fencing agents and independent paths appropriate to the platform. Do not disable fencing merely to make failover proceed when its failure is signaling unresolved ownership risk.
Check the result and rollback
Test exclusion and takeover with a nonproduction resource under partition and management-path failure. Abort promotion if exclusion cannot be established; restore the supported fencing configuration before relying on automatic recovery.