Evacuation will corrupt instance allocations

[Dan Smith]

The following sequence of events will result in a corrupted instance allocation in placement:

1. Instance running on host A, placement has allocations for instance on host A
2. Host A goes down
3. Instance is evacuated to host B, host B creates duplicated allocations in placement for instance
4. Host A comes up, notices that instance is gone, deletes all allocations for instance on both hosts A and B
5. Instance now has no allocations for a period
6. Eventually, host B will re-create the allocations for the instance

The period between #4 and #6 will have the scheduler making bad decisions because it thinks host B is less loaded than it is.

[Chris Dent (cdent)]

I guess a generic question here is: Do we want it to be possible for a compute-node to be able to delete allocations it hasn't created itself? Or should it only be able to delete those it created itself?

[Matt Riedemann (mriedem)]

Where does this happen today?

4. Host A comes up, notices that instance is gone, deletes all allocations for instance on both hosts A and B

Where in the code I mean?

[Sean Dague (sdague)]

Clarification question from mriedem

[Chris Dent (cdent)]

https://bugs.launchpad.net/nova/+bug/1709902 duplcates this, and that one has code, so invalidating this one.