Need clarification regarding split-brain

[tschmidt]

I run a (production) 4-node cluster without QDevice.

In this forum and on www.reddit.com/r/Proxmox the common opinion seems to be that such a cluster (or any even one) will go into spilt-brain (i.e. multiple independently active partitions) under some unspecified circumstances. I never find any details. Just the claim that it's well documented / known.

But from what I understand of proxmox and it's default configuration this should not be possible. The worst case I can find is all nodes going down. Which is much better compared to split-brain wrecking my data.

E.g. in a 2 + 2 (n/2 + n/2) partition neither got the required 3 (n/2 + 1) votes needed for a corosync quorum and both go down.

Is there something wrong in my understanding of proxmox or corosync_votequorum? A bug? Is the claim simply wrong?

 

[leesteken]

You're right that this is prevented by quorum requiring more than half the nodes: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#_quorum . However, one can manually relax this requirement (expected number of votes) and then you can get into split-brain problems.
The QDevice is just to enable the cluster to work with one less node: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#_corosync_external_vote_support . 4 nodes with 2 failures has no quorum. 4 nodes with QDevice and 2 failures has quorum (and the QDevice will only vote for one set of two nodes in case the other two nodes are still running, to prevent split-brain).,

 

[bbgeek17]

But from what I understand of proxmox and it's default configuration this should not be possible. The worst case I can find is all nodes going down. Which is much better compared to split-brain wrecking my data.

Clustering protocols are inherently complex, with multiple safeguards in place to prevent a true "split-brain" scenario. However, the term is often used informally to describe situations where the cluster becomes equally partitioned, leading to a full outage or reboot. In this case full reboot is the last resort to prevent actual split-brain.

One key protection mechanism is STONITH (Shoot The Other Node In The Head), which ensures that a failed or unreachable node is forcibly powered down to maintain cluster integrity. STONITH Explanation.

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

 

[ghusson]

Hello. Just to be precise : in case of no quorum, and if HA is unconfigured, then no host is rebooted and no VM is shutdown. You would simply be unallowed to do any modification on state (configuration, VM stop/start and so on).
But if HA is configured and there is no quorum, each node is rebooted and no VM is booted after that.