Fencing off cluster services based on access keys for shared storage

A computer program product comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein to be executed by one or more processors, the program code including instructions to:

• generate, by a fencing service, an access key using a generation identifier included in a cluster membership message, in response to receiving the cluster message upon removal of a first service from membership in a first node in a cluster;
• send, by the fencing service, the access key to a shared storage, thereby enabling the shared storage to create signing keys which are generated using the access key, and which are used to validate signed requests to access resources stored by the shared storage;
• generate, by a second service in a second node in the cluster, the access key using the generation identifier, in response to receiving the cluster message;
• and
• access, by the second service, a resource previously accessed by the first service, by generating a signing key using the access key and a request to access the resource stored by the shared storage, and then sending the request signed by the signing key to the shared storage;
• and
• wherein the fencing service identifies a type of the resource accessed by the first service which was removed from membership in the cluster, and enables the shared storage to create signing keys which are used to validate signed requests from services to access the type of the resource stored by the shared storage.

A computer-implemented method for fencing off cluster services based on access keys for shared storage, comprising:

• generating, by a fencing service, an access key using a generation identifier included in a cluster membership message, in response to receiving the cluster message upon a removal of a first service from membership in a first node in a cluster;
• sending, by the fencing service, the access key to a shared storage, thereby enabling the shared storage to create signing keys which are generated using the access key, and which are used to validate signed requests to access resources stored by the shared storage;
• generating, by a second service in a second node in the cluster, the access key using the generation identifier, in response to receiving the cluster message;
• and
• accessing, by the second service, a resource previously accessed by the first service, by generating a signing key using the access key and a request to access the resource stored by the shared storage, and then sending the request signed by the signing key to the shared storage;
• and
• wherein the fencing service identifies a type of the resource accessed by the first service which was removed from membership in the cluster, and enables the shared storage to create signing keys which are used to validate signed requests from services to access the type of the resource stored by the shared storage.