How to set up iSCSI target high availability with PCS

Keeping an iSCSI target reachable through a single storage IP simplifies initiator configuration and shortens outages during node maintenance or failure. A floating IP provides a stable endpoint so initiators reconnect to the same address after failover, even when the active target node changes.

A Pacemaker and Corosync cluster managed through pcs treats the storage endpoint as a set of resources. An IPaddr2 resource assigns the floating IP, and a systemd resource manages the iSCSI target daemon; grouping the resources keeps ordering and colocation consistent so the IP comes up before the target starts.

Backing storage and target definitions must match across nodes so the same LUNs and ACLs are presented after a move. Keep LIO configuration (commonly /etc/target/saveconfig.json) or tgt configuration (commonly /etc/tgt/targets.conf) identical across nodes. Storage services require fencing (STONITH) to avoid a split-brain exporting the same block devices from multiple nodes, which can corrupt data, and failover interrupts existing iSCSI sessions until initiators reconnect.

Steps to set up iSCSI target high availability with PCS:

Confirm the cluster is online with quorum.

$ sudo pcs status
Cluster name: clustername
Stack: corosync
Current DC: node-02 (version 2.1.7) - partition with quorum
Last updated: Tue Dec 30 10:11:07 2025
Last change:  Tue Dec 30 09:55:18 2025 by hacluster via crmd on node-02

2 nodes configured
0 resource instances configured

Online: [ node-01 node-02 ]

Identify the iSCSI target service unit name used on the nodes.

$ systemctl list-unit-files --type=service | grep -E '^(target|targetctl|tgtd|tgt)\.service'
target.service     enabled  enabled
tgtd.service       disabled disabled

Stop and disable the iSCSI target service on every cluster node before handing control to pcs.
```
$ sudo systemctl disable --now target
Removed "/etc/systemd/system/multi-user.target.wants/target.service".
```
Replace target with the unit name identified earlier.

Stopping the target disconnects iSCSI sessions and interrupts active I/O.

Related: How to manage Pacemaker cluster services with systemctl in Linux
Create a floating IP resource for the storage endpoint.
```
$ sudo pcs resource create iscsi_ip ocf:heartbeat:IPaddr2 ip=192.168.111.68 cidr_netmask=24 op monitor interval=30s
```
Use an unused address in the storage subnet so initiators keep a stable target IP.

Related: How to create a floating IP address in Pacemaker
Create the iSCSI target systemd resource.
```
$ sudo pcs resource create iscsi_service systemd:target op monitor interval=30s
```
Use systemd:tgtd or systemd:tgt when those units are present.
Group the floating IP resource with the iSCSI target service resource.
```
$ sudo pcs resource group add iscsi-stack iscsi_ip iscsi_service
```
Resources in a group start in listed order and stop in reverse order.

If the exported LUN depends on a clustered device activation or a mount, place that resource in the same group before iscsi_service so the backstore is available before the target starts.

Related: How to create a Pacemaker resource group

Verify the resource group placement.

$ sudo pcs status resources
 Resource Group: iscsi-stack
  iscsi_ip      (ocf::heartbeat:IPaddr2): Started node-02
  iscsi_service (systemd:target): Started node-02

Confirm the floating IP is assigned on the active node.

$ ip -br address show | grep -F '192.168.111.68'
ens192          UP             192.168.111.10/24 192.168.111.68/24

Confirm the iSCSI target is listening on TCP port 3260 on the floating IP.

$ sudo ss -ltn sport = :3260
State  Recv-Q Send-Q Local Address:Port     Peer Address:Port
LISTEN 0      256    192.168.111.68:3260   0.0.0.0:*

Move the resource group for a controlled failover test.
```
$ sudo pcs resource move iscsi-stack node-01
```
Replace node-01 with the desired failover node name.

Failover drops existing iSCSI sessions until initiators reconnect.

Related: How to run a Pacemaker failover test with PCS

Verify the resource group runs on the failover node.

$ sudo pcs status resources
 Resource Group: iscsi-stack
  iscsi_ip      (ocf::heartbeat:IPaddr2): Started node-01
  iscsi_service (systemd:target): Started node-01

Clear the temporary move constraint after testing.
```
$ sudo pcs resource clear iscsi-stack
```
Clearing the move returns placement decisions to the cluster scheduler.