Merge "Clarifying fault propagation between phys-virtual"

diff --combined requirements/03-architecture.rst
index 1b05935,b55d5a0..2f9d24b
--- 1/requirements/03-architecture.rst
--- 2/requirements/03-architecture.rst
+++ b/requirements/03-architecture.rst
@@@ -69,13 -69,12 +69,13 @@@ General Features and Requirement
  The following features are required for the VIM to achieve high availability of
  applications (e.g., MME, S/P-GW) and the Network Services:
  
 -* Monitoring: Monitor physical and virtual resources.
 -* Detection: Detect unavailability of physical resources.
 -* Correlation and Cognition: Correlate faults and identify affected virtual
 -  resources.
 -* Notification: Notify unavailable virtual resources to their Consumer(s).
 -* Recovery action: Execute actions to process fault recovery and maintenance.
 +1. Monitoring: Monitor physical and virtual resources.
 +2. Detection: Detect unavailability of physical resources.
 +3. Correlation and Cognition: Correlate faults and identify affected virtual
 +   resources.
 +4. Notification: Notify unavailable virtual resources to their Consumer(s).
 +5. Fencing: Shut down or isolate a faulty resource
 +6. Recovery action: Execute actions to process fault recovery and maintenance.
  
  The time interval between the instant that an event is detected by the
  monitoring system and the Consumer notification of unavailable resources shall
@@@ -128,9 -127,12 +128,12 @@@ affected by failures on the physical re
  virtualized resource is determined by referring to the mapping of physical and
  virtualized resources.
  
- The relation from physical resources to virtualized resources shall be
- configurable, as the cause of unavailability of virtualized resources can be
- different in technologies and policies of deployment.
+ VIM shall allow configuration of fault correlation between physical and
+ virtual resources. VIM shall support correlating faults:
+ 
+ * between a physical resource and another physical resource
+ * between a physical resource and a virtual resource
+ * between a virtual resource and another virtual resource
  
  Failure aggregation is also required in this feature, e.g., a user may request
  to be only notified if failures on more than two standby VMs in an (N+M)
@@@ -158,42 -160,24 +161,42 @@@ would lead to heavy signaling traffic. 
  messaging model is better suited for these notifications, as notifications are
  only sent to subscribed consumers.
  
 -Note: the VIM should only accept individual notification URLs for each resource
 -by its owner or administrator.
 +Notifications will be send out along with the configuration by the consumer.
 +The configuration includes endpoint(s) in which the consumers can specify
 +multiple targets for the notification subscription, so that various and
 +multiple receiver functions can consume the notification message.
 +Also, the conditions for notifications shall be configurable, such that
 +the consumer can set according policies, e.g. whether it wants to receive
 +fault notifications or not.
  
 +Note: the VIM should only accept notification subscriptions for each resource
 +by its owner or administrator.
  Notifications to the Consumer about the unavailability of virtualized
  resources will include a description of the fault, preferably with sufficient
 -abstraction rather than detailed physical fault information. Flexibility in
 -notifications is important. For example, the receiver function in the
 -consumer-side implementation could have different schema, location, and policies
 -(e.g. receive or not, aggregate events with the same cause, etc.).
 +abstraction rather than detailed physical fault information.
 +
 +.. _fencing:
 +
 +Fencing
 +^^^^^^^
 +Recovery actions, e.g. safe VM evacuation, have to be preceded by fencing the
 +failed host. Fencing hereby means to isolate or shut down a faulty resource.
 +Without fencing -- when the perceived disconnection is due to some transient
 +or partial failure -- the evacuation might lead into two identical instances
 +running together and having a dangerous conflict.
 +
 +There is a cross-project effort in OpenStack ongoing to implement fencing. A
 +general description of fencing in OpenStack is available here:
 +https://wiki.openstack.org/wiki/Fencing_Instances_of_an_Unreachable_Host .
  
  Recovery Action
  ^^^^^^^^^^^^^^^
  
 -In the basic "Fault management using ACT-STBY configuration" use case, no
 -automatic actions will be taken by the VIM, but all recovery actions executed by
 -the VIM and the NFVI will be instructed and coordinated by the Consumer.
 +In the basic :ref:`uc-fault1` use case, no automatic actions will be taken by
 +the VIM, but all recovery actions executed by the VIM and the NFVI will be
 +instructed and coordinated by the Consumer.
  
 -In a more advanced use case, the VIM shall be able to recover the failed virtual 
 +In a more advanced use case, the VIM shall be able to recover the failed virtual
  resources according to a pre-defined behavior for that resource. In principle
  this means that the owner of the resource (i.e., its consumer or administrator)
  can define which recovery actions shall be taken by the VIM. Examples are a