Root cause
The switch port for the corosync VLAN was not brought back up after
maintenance. Corosync on ring 1 (the dedicated cluster link) is
partitioned, so each node sees itself as the only member of a
single-node partition and refuses to take cluster actions.
A common alternative cause is asymmetric routing on the corosync
VLAN — one node still has its old default route for that subnet.
Remediation
1. Verify the switch port: `show interface status` on the switch for
the corosync ports.
2. Bring the port up: `no shutdown` on the corresponding interface.
3. On each node, bounce the corosync link: `ifdown <corosync-iface>;
ifup <corosync-iface>`.
4. Recheck: `pvecm status` should return to Quorate: Yes.
If the link is up but corosync still won't converge, check that the
VLAN is correctly trunked through any intermediate switches.
Verification
- `pvecm status` shows Quorate: Yes with 3 active votes
- `pvecm nodes` lists all three nodes
- `ha-manager status` returns without errors
- VMs can be started, stopped, and migrated normally
Prevention
- Run the corosync link on a physically separate switch if possible
- Document the maintenance procedure to include port verification
- Consider deploying a QDevice as an additional tie-breaker
- Add a corosync health check to the daily checklist