4.6.3. Creating an IP address resource to manage an IP address that can move across multiple AWS Availability Zones

Procedure

1. Install the resource-agents package:

   # dnf install resource-agents

2. Optional: View the options and default operations for awsvip:

   # pcs resource describe aws-vpc-move-ip

3. Set up an OverlayIPAgent IAM policy for the IAM user.

   1. In the AWS console, navigate to Services IAM Policies Create OverlayIPAgent Policy

   2. Input the following configuration, and change the <region>, <account_id>, and <cluster_route_table_id> values to correspond with your cluster.

      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Sid": "Stmt1424870324000",
                  "Effect": "Allow",
                  "Action":  "ec2:DescribeRouteTables",
                  "Resource": "*"
              },
              {
                  "Sid": "Stmt1424860166260",
                  "Action": [
                      "ec2:CreateRoute",
                      "ec2:ReplaceRoute"
                  ],
                  "Effect": "Allow",
                  "Resource": "arn:aws:ec2:_<region>_:_<account_id>_:route-table/_<cluster_route_table_id>_"
              }
          ]
      }

4. In the AWS console, disable the Source/Destination Check function on all nodes in the cluster.

   To do this, right-click each node Networking Change Source/Destination Checks. In the pop-up message that is displayed, click Yes, Disable.

5. Create a route table for the cluster. To do so, use the following command on one node in the cluster:

   # aws ec2 create-route --route-table-id <cluster_route_table_id> --destination-cidr-block <new_cidr_block_ip/net_mask> --instance-id <cluster_node_id>

   In the command, replace values as follows:

   • ClusterRouteTableID: The route table ID for the existing cluster Virtual Private Cloud (VPC) route table.
   • NewCIDRblockIP: A new IP address and netmask outside of the VPC classless inter-domain routing (CIDR) block. For example, if the VPC CIDR block is 172.31.0.0/16, the new IP address or netmask can be 192.168.0.15/32.
   • ClusterNodeID: The instance ID for another node in the cluster.

6. On one of the nodes in the cluster, create a aws-vpc-move-ip resource that uses a free IP address that is accessible to the client. The following example creates a resource named vpcip that uses IP 192.168.0.15.

   # pcs resource create vpcip aws-vpc-move-ip ip=192.168.0.15 interface=eth0 routing_table=<cluster_route_table_id>

7. On all nodes in the cluster, edit the /etc/hosts/ file, and add a line with the IP address of the newly created resource. For example:

   192.168.0.15 vpcip

Verification

1. Test the failover ability of the new aws-vpc-move-ip resource:

   # pcs resource move vpcip

2. If the failover succeeded, remove the automatically created constraint after the move of the vpcip resource:

   # pcs resource clear vpcip