How to configure pacemaker cibsecret when direct root SSH login is disabled

Environment

• Red Hat Enterprise Linux 8,9 (with the High Availability Add On)
• Pacemaker

Issue

• When attempting to store a pacemaker resource or STONITH parameter as a secret using the cibsecret utility in a Pacemaker cluster, the operation fails or hangs because SSH-based synchronization to other cluster nodes requires direct root SSH login, which is disabled in the environment.
• The terminal displays prompt messages for root authentication on the peer nodes during execution: INFO: syncing /var/lib/pacemaker/lrm/secrets/<resource-id>/<parameter> to node2 ...root@node2's password:

Resolution

By default, the cibsecret utility automatically synchronizes secret files to peer cluster nodes via SSH using root privileges. If direct root SSH login is disabled in the environment, this automated synchronization fails.

The native -C flag can be used to configure the secrets locally on each node individually, bypassing both direct CIB modification and SSH-based synchronization during the creation phase.

1. Put the cluster into maintenance mode to prevent resource restarts or state checks while setting up attributes:

   # pcs property set maintenance-mode=true
   

2. Execute the cibsecret command with the -C flag on each cluster node individually to write the secret locally:

   # cibsecret -C set <resource-id> <parameter-name> <secret-value>
   

   Note : * Replace <resource-id> with the pacemaker resource ID, <parameter-name> with the parameter to be secured (such as monpassword), and <secret-value> with the password itself.

3. On the first node (where CIB configuration is managed), update the resource attributes to reference the secret parameter using lrm:// :

   # pcs resource update <resource-id> <parameter-name>=lrm://
   

4. Verify that the resource configuration now shows lrm:// for the secured attribute:

   # pcs resource config <resource-id>
   

5. Remove the cluster from maintenance mode:

   # pcs property set maintenance-mode=false
   

Root Cause

The cibsecret utility relies on passwordless or direct root SSH login to automatically push configured secret and signature files to peer cluster nodes. When direct root SSH login is disabled, the automated multi-node synchronization step fails to authenticate.

Diagnostic Steps

1. Verify if direct root SSH login is disabled between cluster nodes. Running an SSH command to root on the other node prompts for credentials:

   # ssh root@<peer-node-hostname>
   

Related Solutions

• Is there a way to store secrets in pacemaker?
• Can pacemaker store encrypted sensitive information?

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.