Why fencing exists - the cluster discipline

Fencing exists because quorum alone is not enough. This lesson covers why fencing is required and what it does.

The problem

Quorum decides who can make cluster decisions. Fencing enforces that decision.

Without fencing, even with quorum:

• The minority group still has the workload running.
• The minority group’s database is still mounted.
• The minority group’s services are still serving.
• The minority group can still write to shared storage.

If the minority group writes to shared storage while the majority group also writes, data is corrupted. Quorum prevents the decisions; fencing prevents the writes.

What fencing does

Fencing forcibly stops a node from accessing the workload:

• Power fencing: power off the node (IPMI, BMC, iLO).
• Storage fencing: SCSI reservations, SAN lockout.
• Hypervisor fencing: stop the VM, undefine it.
• Network fencing: cut the network (last resort).

After fencing, the node is guaranteed to be stopped. The storage layer can safely give the resource to another node.

Why both quorum and fencing

Quorum and fencing are complementary:

• Quorum prevents the minority from making decisions (e.g. “promote me to primary”).
• Fencing prevents the minority from acting (e.g. writing to storage).

Both are required. Quorum without fencing: the minority can still write. Fencing without quorum: the wrong group may be fenced.

The production impact

A cluster without fencing is a cluster waiting to corrupt data. The first partition triggers split brain; the first write after the partition corrupts data; the first restore fails.

In production, fencing is mandatory. The cost of implementing fencing is much less than the cost of a single data corruption event.

Knowledge check