Let's say I have two instances of HAProxy running in a cluster to provide load balancing for something else. The two node HAProxy cluster could be implemented using Pacemaker and Corosync.
Consider the situation where the two nodes lose contact with each other (But are still accessible to the outside world). In this situation, they would decided to BOTH take the Virtual IP associated with this cluster. Could this situation occur? If so, do you have to implement STONITH to protect the virtual IP resource? Is there any way to solve this problem without STONITH?
You would should not need stonith because HAProxy doesn't need a shared storage container. If your clustered pair go into a split brain situation why would it matter? Which ever one your router chooses to hit will work fine.
You will probably want the following in sysctl.conf:
#Allow haproxy to start without the interface present - Required for stick table replication:
net.ipv4.ip_nonlocal_bind = 1
Also make sure that your HA solution fails gracefully i.e. in a split brain scenario make sure BOTH nodes try and go live (At Loadbalancer.org we've used several patches to HA-Linux heartbeat to ensure that happens) However after saying all that a hardware implementation of STONITH would also work.