Rollback time namenode ha

From Hadoop: The Definitive Guide , I find it easy to understand and pretty straight forward.
Fault tolerance and fencing

The transition from active changeover to standby mode is accomplished through a new object in the system called a fault tolerance controller. Fault tolerance controllers are plugged in, but the first implementation uses ZooKeeper to keep only one node active. Each namenode starts a failover process control, whose job is to monitor its namenode for failures (using a simple heartbeat mechanism) and initiate a failover on naming failure.

Fault tolerance can also be manually initiated by the administrator, for example, during ongoing maintenance. This is known as graceful failover because the failover controller orders the transition for both naming to switch roles.

In the case, however, it is impossible to be sure that the namenode failed to start. For example, a slow network or network partition may initiate a failover even though the previously active namenode is still running and thinks it is still the active namenode. Implementing HA is essential to ensure that a previously active namenode failed to perform damage and corruption — a technique known as swordsmanship. The system uses a number of fencing mechanisms, including killing the namenodes, revoking its access to shared storage (usually with a vendor-specific NFS command) and disabling its network port with a remote control command. As a last resort, the formerly active nomenod can be fenced off with a technology rather visibly known as STONITH, or "shoot another node in the head"which uses a dedicated power distribution unit to force shutdown the host machine.

Client failover is handled transparently by the client library. The simplest implementation uses a client-side configuration for failover management. The HDFS URI uses a logical hostname that maps to a pair of address names (in the configuration file) and the client library tries each address change until the operation succeeds.

Hope it helps!