Enforce stonith for ComputeInstanceHA nodes

With the implementation of stonith levels support via bacfec8647 we
accidentally lifted the requirement for ComputeInstanceHA nodes to
have at least one valid stonith device.

This commit re-introduces a check to make sure there is at least
one valid fencing agent configured, computing the total number of
stonith resources belonging to each node and making sure to raise
an exception if this value is zero.

This check is performed only for the first level so to allow
different stonith topologies per node (eg controller nodes can
have two levels, while computes only one) and still account for
the missing devices.

Closes Bug: #1953042

Change-Id: I5ca68bcc2cfe34f2e95758628155e4f5b872305a
(cherry picked from commit a4fa4fbb76)

manifests/fencing.pp

@@ -147,10 +147,25 @@ class tripleo::fencing(
       'rhevm' => $rhev_devices, 'cisco_ucs' => $ucs_devices
     }
 
+    # let's store the number of stonith devices created for this server.
+    # this will be used to detect if there is a least one and fail if
+    # instance_ha is configured and puppet is running on a compute node.
+    $data_num = [
+      length($ironic_devices), length($redfish_devices),
+      length($ipmilan_devices), length($kdump_devices), length($rhev_devices)
+    ]
+
+    $sum = $data_num.reduce |$memo, $value| { $memo + $value }
+
     $data.each |$items| {
       $driver = $items[0]
       $driver_devices = $items[1]
 
+      # if there is no valid stonith device and this is a compute-instanceha node we raise an exception
+      if $level == '1' and $sum == 0 and $enable_instanceha and $is_compute_instanceha_node {
+        fail('Instance HA requires at least one valid stonith device')
+      }
+
       if $driver_devices and length($driver_devices) == 1 {
         $mac = keys($driver_devices)[0]
         $safe_mac = regsubst($mac, ':', '', 'G')