Autonomy and control
You choose who applies a plan: nobody, an operator, or the appliance. The level is set per
installation by an admin, and every change is journaled.
| Level | What Aicerine does | Who applies |
|---|---|---|
observe | Measures, plans, and journals what it would have done | Nobody |
assisted | The same, and runs a plan once an operator approves it in the console | The operator |
active | Runs the plans that pass your policy and the guardrails | The appliance |
A pilot starts in observe. In observe, Aicerine holds no credential that can migrate a VM or
write to Placement: that credential is created only when you move to assisted. See
OpenStack.
Guardrails
Every plan passes the same guardrails, at every level. Their values are part of your policy, and the console shows them next to each decision.
| Guardrail | Failure it prevents |
|---|---|
| Dead band: act only when the predicted gain is above a threshold | Oscillation |
| Cool-down per VM and per host | Ping-pong between two hosts |
Concurrency: Nova's max_concurrent_live_migrations per host, and a global ceiling | Migration storms |
| Rate: a maximum number of moves per hour per aggregate | Migration storms |
| Maintenance windows: plans run only inside the windows you declare, except in an emergency you define | Surprises during business hours |
| Check after the fact: load re-measured on source and target | Repeating a harmful plan |
| Non-converging migration: Nova aborts it; Aicerine forces completion only if you allowed it | A frozen VM |
Emergency stop
The emergency stop freezes the three levels at once: no new migration and no Placement write starts while it is set. Migrations already running are left to finish, because an interrupted migration costs more than a finished one.
Any operator can set the stop. Only an admin can lift it.
Rollback
- Set the emergency stop.
- Restore the target ratio on every host. One command does it, and the write is journaled.
VMs that have already moved stay where they are. Moving one back is a plan like any other.
Without Aicerine's ratios and migrations, your cloud runs exactly as it did before: Nova never depended on the appliance.