fix(ha): use crm_mon for Active node detection and add cleanup before VIP wait

acceptance-tests.sh: replace drbdadm-role-based Active node detection with
crm_mon-based detection. DRBD role briefly reads Secondary during Pacemaker
transitions, causing T2/T3/T4 to target the wrong node. crm_mon Promoted:/
Masters: lines are authoritative; wait up to 90 s for Pacemaker to settle
before falling back to NODE1.

cluster-init.sh: add crm_resource --cleanup before the VIP wait loop so
stale migration-threshold failure counters from previous cluster-init runs
are cleared before Pacemaker decides resource placement.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/ha/acceptance-tests.sh

@@ -35,17 +35,34 @@ echo " HA Cluster Acceptance Tests — $(date '+%Y-%m-%d %H:%M:%S')"
 echo "════════════════════════════════════════════════════"
 
 # ── Detect Active/Standby nodes ────────────────────────────────────────────
-# Pacemaker can promote either node; determine which is currently Active
-# (DRBD Primary / holds ha-group resources) before running tests.
+# Use crm_mon to detect which node holds the Promoted (Primary) DRBD resource.
+# Pacemaker is authoritative; DRBD role can briefly read as Secondary while
+# Pacemaker is mid-transition, giving a false Active/Standby swap.
+# Wait up to 90 s for Pacemaker to settle before giving up.
 echo ""
-echo "Detecting Active/Standby nodes..."
-if n1 "drbdadm role ha-data" 2>/dev/null | grep -q "^Primary"; then
-  ACTIVE_NODE="$NODE1"; ACTIVE_IP="$NODE1_IP"
+echo "Detecting Active/Standby nodes (waiting for Pacemaker to settle)..."
+ACTIVE_NODE=""
+for i in $(seq 1 30); do
+  # crm_mon -1 output contains "Promoted: [ <node> ]" for the DRBD master.
+  CRM_OUT=$(n1 "crm_mon -1 2>/dev/null" 2>/dev/null || n2 "crm_mon -1 2>/dev/null" 2>/dev/null || true)
+  # Match "Promoted:" (Pacemaker 2.x) or "Masters:" (Pacemaker 1.x), not "Unpromoted:"/"Slaves:"
+  ACTIVE_NODE=$(echo "$CRM_OUT" | grep -E '^\s*(Promoted|Masters):' | grep -oE '\b(ha-server-[0-9]+)\b' | head -1 || true)
+  [[ -n "$ACTIVE_NODE" ]] && break
+  sleep 3
+done
+
+if [[ -z "$ACTIVE_NODE" ]]; then
+  echo "  WARNING: could not determine Active node from crm_mon after 90 s — defaulting to $NODE1"
+  ACTIVE_NODE="$NODE1"
+fi
+
+if [[ "$ACTIVE_NODE" == "$NODE1" ]]; then
+  ACTIVE_IP="$NODE1_IP"
   STANDBY_NODE="$NODE2"; STANDBY_IP="$NODE2_IP"
   na() { n1 "$@"; }
   ns() { n2 "$@"; }
 else
-  ACTIVE_NODE="$NODE2"; ACTIVE_IP="$NODE2_IP"
+  ACTIVE_IP="$NODE2_IP"
   STANDBY_NODE="$NODE1"; STANDBY_IP="$NODE1_IP"
   na() { n2 "$@"; }
   ns() { n1 "$@"; }

scripts/ha/cluster-init.sh

@@ -399,6 +399,9 @@ cibadmin --replace --scope constraints --xml-text '<constraints>
   <rsc_colocation id="coloc-group-with-drbd" score="INFINITY" rsc="ha-group" with-rsc="ms-drbd0" with-rsc-role="Promoted"/>
 </constraints>'
 
+log "Clearing stale Pacemaker failure history..."
+crm_resource --cleanup 2>/dev/null || true
+
 log "Waiting for resources to start..."
 for i in $(seq 1 60); do
   if crm_resource -r vip --locate 2>/dev/null | grep -q "running on"; then

secrets/ha-corosync-authkey

@@ -1,22 +1,22 @@
 {
-	"data": "ENC[AES256_GCM,data:OhP8SVhryu47dc6zPBaYPrdoMzzRcyIyh82iirbw7LnJuyRfwYzb6VrLkHLXsqZRxb0UzQ7HMNt/o42vvbXIG0nFgfGGfVaaRgMo9ib0ThzldvLGgC23QcgH5oJvOYjzWDQ2FXMVtYzW2ibY80ZsqJUJUj/PyzHDrEi10vTDwPR1VAuEfc2rl05aJGm54dun1fUFO1EqucvjC6T5qbikcQ8duIz5M/1YXhWwWU+8FcX4ebVdbIGM6AqIy4pe8fBgQu5cTJmDUPt/OGAkaftvMV/MYobA9pJ1zhKUPx9yXLHDrQqUHKMCVv4qkpiM1Tlm5g+klqerKM7lm21VG0pn8g==,iv:u9XfPNM/g1DUoEB1MzIbZ01IUj49D1NMXRNGgPOdhaM=,tag:S4jCBUSLOEAVT+ZXetMoVg==,type:str]",
+	"data": "ENC[AES256_GCM,data:vQdlyhCx5MxkKejLp3lMqayk6/YtLwqPMLwEnfjIG6EJs9UOuFIwOMF8zA/vk4LtbzVwWaK5rv2tZgjbdm2Mkxr7HUxFvS0N20ctfzH0lti4TQWpMAIbN+D7RpcRrFg8lZb30hb2C81ilduQ+ONc0E7EXc8M/K2r4JJZzrX0k/L/pvn0GCTAvuj0GnLsGSLjEvpx1SGwzG5HGctBTALJGerGPhXpxySQqY6YljdQlvr2gYEfKaBjZTau1HDbrZD/8IM+K+nUOwgAR/VRpfYGOGmIBkHqD394WTPq0Z7L656TtIlX3wBsCXYlO2O9bdDSgwECCodXckWarkXBKJHOQQ==,iv:K8aEoqgtBLsICUOZt3lejhTlweTk0+rm8I/VP8cNitE=,tag:6xxwJFEcRkxKdTuqzIfVKg==,type:str]",
 	"sops": {
 		"age": [
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxQXYvbk5IbTdDZnMwOENs\nU1RMR0J5Y3Mza3pwREc4bDMyblRJUWFaTTJnCkZ1czZKd1dIYUlsRStNanlmYm9i\nd1QrZ0xxWDJad2tsVmF6MjFZa2N4NWcKLS0tIFlxdW15QVljZFJFWWhEaXl2aG4w\ndlIzUGpvVlRDaVJ2QlRHbDhaN1MyYlkKe30ld5MN7DFND+FJLGxghOblkxbq7OPG\nxT5cNbMaewu4JRly3A0EGtqWTjum7K0KRA5CDomEmV+DAg5Vk3Y5tA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpNnRSUjFHL2I2N0craFp4\nNlBoRHNpbC93eC9qN2dOYnpJSllIV04yT0VzCkFBMEtoa0RzenJLNjlYT3QrcXMz\nS1hXZGszNkFIaUVpdVJYSmVVcTY1d3cKLS0tIG03bTRtWjlkQ2ZOTml1OFBLUVAv\nbTZnUStlOGdiVHlidXBXUXBtNm53MEkKdBtpkEVmymmbzuuBvnl4TwjOi+khaboO\nXSMlBkSkE7ynYAomtleUwt3WP6nVSok5TOCVCEn3S6h8ZZITiYNxVw==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKRm1TRzd0WHNSNUlrMVk3\nV0d0cXFVUWFkQ0FkR2gyWmhJR2dneVRQU25NCmt3UGU2Qy9zTVpNbDhvSTBncG83\nVk40T2JRNVZnODRQZmQ1WlN2Zm9YOGcKLS0tIGRtVzUyem42K0Y5a3BZeGlzWEd3\nN0lkMmo4Yjh0eWxTS2lWUEN6dUFJejgKukeA9kNDKkMIGsiuz9I+Ym9+Z/uZNPsT\npJ+ETkPSKW0gi6qZpr7BqN1KottbhMgFv8WXrtv+tOSIQUZl8eCVNw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYWEdKbnducHcxY0d2Y1l5\nWE9TVFU2MEV2WndlNEQ0WGtNRnJZcVU0bUNrCmdlb3dnUnA3OXlXQ0dqZk5SR1hw\naUtBd2ZIZkQxMDIwbHp3UUhxd2FUamcKLS0tIEpjMHpiZjUwZlhSVitCbXZIK0Rw\nVXZwL1FsOFBjeXZZQjlrZ0NlNzdFTXMKe0kL289rbT7BAf9gduWZdoga87tLdJLP\nHhRUrDMta6FVFtJgk3gA+VcsIhVJV++1+Zb3YgHSzSvnRxhhH8CrLQ==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1k73g8x47hs93wcv7qh92n3htz8pl295g49hyvlrf3570mts0hgys5g04d6"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNNS9ES0l2VDhjN2c1RWhl\nNFN5ZmhkUlBiNE9EbVlNb2RzaXRicDRpSG5vClBCRmJhTklCY2haV3VYNENPeHZH\nWGZqOW1kWFhwQkw0WVdBNjJUalEzMmsKLS0tIDdiVmdDZDY2YzJuT2tnZHpKRCtK\nQzIwYTBnZUhYc081S3czWjNScjBHeDQKzzihvBhwwpONkg9p66xpYNn4NAKQxLri\n+KhqKFmHw5vPA9aG778adduNzckPs7JquSHCug74OTweoxRVw0gVgA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUOTZ5S1VvTTNVK1dYVnI3\nL2dRdkN1bXZpSXJnRWR4bXFQeHcwSXdWK2w0CmlhWDl1cHdOek5BUi9Mb0ovaEZK\nVm9IQUhwYmIweFJzSGowUFNRVTZoWFkKLS0tIDlMZmY0MHJpdlFnMXJZK1dhZkhL\nRUZiZmE0YTNaU1hsUEwwWFVYUlpEQkUKWRHmltokpoZBPuSs3QibQ5W0ICs9gFrv\nYe3Kc2umaZemXOgs20isuxFLx/qsVnSwS1rS/SaUlyNN6aJvOZp7Uw==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1fefy6dk8zn5c3edwmrs9vwx79quftnt784m628t9e34q3ft3cehqz8u72r"
 			}
 		],
-		"lastmodified": "2026-07-28T14:02:48Z",
-		"mac": "ENC[AES256_GCM,data:rqcQW9NP/5PvoatpgjHBx4A6pCw4HKWUSfewP1Mk7+ywBUz869uhIMWW1PYmdjGiX6pre14ba3u7mQ1eZA5FcxoxgCgfjVDH3Emn98d81zMeZRBdCs/D1Fopq5o+0zml/BVXoITrZiEF+AeVkeFKOGndiGgYbrot8PZEp8z27Ms=,iv:9+0MR52NdL7ockzp8QCfM2kBu9pclYZK0nHYbgNsEq4=,tag:AIQo0imL3Kl5xymcVbnTug==,type:str]",
+		"lastmodified": "2026-07-28T14:16:51Z",
+		"mac": "ENC[AES256_GCM,data:V6xUMnWIsy3umTlOOC4vwpwzwrSnFQS16VCgz8MAxYFDVe2dUPDYWrtXxERzzf+RHqKMfQyZ/LPitRwo3i376c9rb5qXBApF39YCsO69b/CG3C4jDXBDBIJbZ6HXFLO++DDScrxo1GaQHHWH/4Es4bZIjZib0YF1DJ5XSUSJHmU=,iv:fC5ymNvXB9fIDIxyeIPi/jHiYuf1xwFmcsFpiewSp5Q=,tag:0slrt9Xecg6AAT/+UP/PtQ==,type:str]",
 		"version": "3.13.3"
 	}
 }