43 lines
1.7 KiB
YAML
43 lines
1.7 KiB
YAML
---
|
|
# HA-managed guests. DELIBERATELY SHORT: the cluster's stated posture is "no HA,
|
|
# guests are disposable" (see ../../../CLAUDE.md). Anything listed here is an
|
|
# exception that has earned it, and the reason belongs in the comment.
|
|
pve_ha_resources:
|
|
# vyos-rtr. It is the gateway for BOTH SDN VNets and an OSPF speaker, so losing
|
|
# it takes labnet+retronet offline (the main LAN is unaffected — the NEC IX is
|
|
# its gateway). Disk is on pve-rg (DRBD, place-count 2), so it can start on any
|
|
# node; pve3 would attach diskless.
|
|
# NOTE this buys crash-RESTART (~1-3 min outage), not seamless failover. Real
|
|
# gateway HA would be a second VyOS with VRRP.
|
|
- sid: "vm:100"
|
|
state: started
|
|
max_restart: 3
|
|
max_relocate: 2
|
|
|
|
# pve3 is the normal home for the critical router. Non-strict preserves pve1
|
|
# and pve2 as failover targets when pve3 is unavailable.
|
|
pve_ha_rules:
|
|
- name: prefer-vyos-pve3
|
|
type: node-affinity
|
|
resources: ["vm:100"]
|
|
nodes: ["pve3:100", "pve1:10", "pve2:10"]
|
|
strict: false
|
|
comment: "Prefer critical VyOS router on pve3, away from CI nodes"
|
|
|
|
pve_ha_portable_vms:
|
|
- vmid: 100
|
|
node: pve3
|
|
cpu: x86-64-v2-AES
|
|
|
|
# --- Watchdog ---------------------------------------------------------------
|
|
# ⚠ WHY THIS MATTERS: adding ANY HA resource arms fencing cluster-wide. PVE's
|
|
# default is `softdog`, a SOFTWARE watchdog — a kernel timer, which CANNOT fire if
|
|
# the kernel itself is frozen. A hardware watchdog is independent silicon and
|
|
# fires regardless.
|
|
#
|
|
# Verified available 2026-07-26:
|
|
# pve1 (Intel i3-6100U) -> iTCO_wdt (timeout 30s)
|
|
# pve2/pve3 (Ryzen 2400GE) -> sp5100_tco (timeout 60s)
|
|
# Set per-host in inventory host_vars; empty string = leave PVE's softdog default.
|
|
pve_ha_watchdog_module: ""
|