TOPIC:

I've just set up a basic 2-node noSAN cluster with xcp-ng 8.1 (following the reference design for XenServer 7, with minor differences - one dedicated 10 Gb SFP+ DAC link between the servers for replication, instead of two bonded 1 Gb). So far so good.
Now, I'm considering adding another one or two hosts to that pool. There would be no HA for less critical VMs running on the added hosts, just like a traditional XenServer setup with shared storage - except that the shared storage would be provided by the first 2 hosts with HA, instead of the dedicated expensive shared RAID array.
Not sure how to best handle the floating IP on the dedicated link that would now have to be available "from outside" to the other hosts, but it should work as Linux has a "weak host model" by default (see RFC1122 for strong/weak ES discussion).
Any dangers of such a setup to watch out for?

Your concept will technically work, however, in the event that the master fails, you would not be able to control which of the remaining slaves would be promoted as the new pool master, which could leave the pool with no storage if one of the 2 additional hosts gets promoted.

Should this occur, you can manually put the iscsi-ha daemon into manual mode on the surviving storage host, elevating its status to DRBD Primary.

I'm not recommending the above as a viable solution, but rather laying out all that you have to work with.

In lieu of the above, the addition of a configuration parameter could address this in a more proper manner, allowing for an override in the selection of a slave to recover the pool. I will be working on a few outstanding bugs in the coming days and weeks and can take a look at this.

Good catch, better to avoid manual steps (opportunities to make a mistake) if possible. So for this to be safe, only one of the two ha-lizard hosts should ever become a master - the added hosts must always be slaves. Not sure exactly how the new pool master is elected - is this done by ha-lizard, or by xcp-ng itself?

New master is selected by HA-Lizard. Decision is based on:

all available hosts -> filter by status OK -> select one. You can see this in the logs. Every few seconds the parameter autopromote_uuid is updated.