Forum Discussion
NimbostratusCreative ways to take members out of pools for maintenance
I have server admins and dev programmers that want to have limited access to the Big IP so that they can disable and enable pool members themselves during maintenance windows. I understand their need but I am not sure I want them to have accounts to access the Big IPs themselves. I am curious what other big ip admins are doing in their environments, what creative solutions there might be to allow this but with very limited access, or even alternative ways to accomplish what they are needing without allowing access to the F5s at all.
Thank you
3 Replies
afedden_1985Cirrus
We have asolution in place where we health check the HTTP servers looking for a specific page on the server and expect a 200. We probe the servers with a string like this GET /health.aspx HTTP/1.1\nHost: defaulthost.my.company.org \nConnection: close\n\n servers normally respond with 200 when healthy. When the servers teams need to do server maintenance they change that page to return a different response code like 600 and that will let F5 fail the server out of the pool for maint. When they are done they restore the original response code 200 and F5 will place the server back into rotation in the pool.
pete_71470Cirrostratus
Our solution is similar to afedden, and for the same concerns (no non-f5-admin owner with anything but readonly). Monitors for web servers here send GET /status.html, expect 'Service is up', and disable string 'Service is down'.
This gives service owners autonomy they really enjoy. They change their own html document to return 'maintenance' or something similar to gracefully remove a pool node, 'Service is down' to match the receive string, and 'Service is disabled' to match the disable string.
The disable string in practice never benefits the service owner because it takes much to long for connections to fade away.
Mike_Sullivan_2I had our team has setup monitor ports, outside the usual service port to query. That way they can control if the pool member is up or down, but still keep the underlying service available for what ever use is needed.
Cheers, Mike
