Demote a node from MCs only after the config. is updated

Otherwise it was possible that a node was demoted (by calling noded),
its configuration copy removed, but before the configuration change took
place, it was distributed to the node again.
Signed-off-by: Petr Pudlak <pudlak@google.com>
Reviewed-by: Klaus Aehlig <aehlig@google.com>

lib/cmdlib/node.py

@@ -771,13 +771,6 @@ class LUNodeSetParams(LogicalUnit):
     self.cfg.Update(node, feedback_fn)
 
     if self.new_role != self.old_role:
-      # Tell the node to demote itself, if no longer MC and not offline
-      if self.old_role == self._ROLE_CANDIDATE and \
-          self.new_role != self._ROLE_OFFLINE:
-        msg = self.rpc.call_node_demote_from_mc(node.name).fail_msg
-        if msg:
-          self.LogWarning("Node failed to demote itself: %s", msg)
-
       new_flags = self._R2F[self.new_role]
       for of, nf, desc in zip(self.old_flags, new_flags, self._FLAGS):
         if of != nf:
@@ -785,6 +778,15 @@ class LUNodeSetParams(LogicalUnit):
       (node.master_candidate, node.drained, node.offline) = new_flags
       self.cfg.Update(node, feedback_fn)
 
+      # Tell the node to demote itself, if no longer MC and not offline.
+      # This must be done only after the configuration is updated so that
+      # it's ensured the node won't receive any further configuration updates.
+      if self.old_role == self._ROLE_CANDIDATE and \
+          self.new_role != self._ROLE_OFFLINE:
+        msg = self.rpc.call_node_demote_from_mc(node.name).fail_msg
+        if msg:
+          self.LogWarning("Node failed to demote itself: %s", msg)
+
       # we locked all nodes, we adjust the CP before updating this node
       if self.lock_all:
         AdjustCandidatePool(self, [node.uuid])