Evacuate non-recovery (’HA_enabled = False’) instances in shutoff status at host failure except specified tenants

This blueprint suggests to add a configuration to change the evacuation mechanism at host failure such that non-recovery (’HA_enabled = False’) instances are evacuated in shutoff status.

When a failed host goes back to system as a reserved host, it’s required to make the host empty to ensure the capacity is same as other hosts belonging to same failover segment, assuming those hosts are same spec. At the same time, since non-recovery instances must not be started as requested, those instances must be evacuated in shutoff status.

Moreover, I suggests to add another configuration to specify tenants whose instances are excluded from the shutoff evacuation mentioned above.

Operator or Internal system may create an ‘Canaria’ instance to monitor the health of each host where it is running. As such instance should be bound to a specified host, it must not be evacuated to other host through its life cycle during failure analysis and repair period.