Virtualization

Configure KVM Fencing and Prove Split-Brain Protection

Configure outer-hypervisor power control for each nested HA node; Isolate the active node; Prove fencing completes before guest restart; Test quorum loss and show that unsafe restart is refused.

By InventiveHQ Team

Episode 24 of the InventiveHQ KVM virtualization series.

Lab verified July 2026 · Ubuntu 26.04 · libvirt 12.0.0 · QEMU 10.2.1

What this episode proves

  • Configure outer-hypervisor power control for each nested HA node
  • Isolate the active node
  • Prove fencing completes before guest restart
  • Test quorum loss and show that unsafe restart is refused

Validated workflow

1. Configure outer-hypervisor power control for each nested HA node

fence_virsh --plug=kvm-ha03 --action=status

2. Isolate the active node

pcs property set stonith-enabled=true

3. Prove fencing completes before guest restart

pcs stonith fence kvm-ha03

4. Test quorum loss and show that unsafe restart is refused

corosync-quorumtool -s

Finished state

Fencing is enabled, tested, and required; all three nodes are healthy and rejoined. The public scripts contain no private keys, passwords, or tokens. Review names, addresses, paths, ownership, backups, quorum, and fencing for your own environment before running them.

Need help from an IT & cybersecurity partner?

InventiveHQ helps businesses secure, modernize, and run their technology. Let's talk about your goals.

Get in touch