CPU pinning requires the KVM hypervisor to start in the paused state, in
order to retrieve information, and immediately unpauses it.

This does not play well with live migration, as the unpausing was done
before the migration started and so the receiving kvm process left the
migrated instance in the stopped status.

This patch fixes this behavior, by not launching the KVM process in
stopped state while on the receiving side of a migration.

Also, the stopping is now done outside _ExecuteCpuAffinity.

Signed-off-by: Andrea Spadaccini <spadaccio@google.com>
Reviewed-by: Tsachy Shacham <tsachy@google.com>

This will be used to implement more easily 'choice' parsing of input
data, without resorting to syntax (case … of Bad _ -> …).

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Agata Murawska <agatamurawska@google.com>

* devel-2.5:
  Add tls_ciphers and use_vdagent options
  Updated man pages with new SPICE TLS options
  Implementation of TLS-protected SPICE connections
  Added SPICE TLS option and related cert paths
  Fix OS creation's error handling when pausing sync

Signed-off-by: Andrea Spadaccini <spadaccio@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Andrea Spadaccini <spadaccio@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

man/gnt-cluster.rst:
* documented the --new-spice-certificate, --spice-certificate and
  --spice-ca-certificate options of renew-crypto.

man/gnt-instance.rst:
* documented the spice_use_tls KVM hypervisor option.

Signed-off-by: Andrea Spadaccini <spadaccio@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Added support for TLS-protected SPICE connections:

client/gnt_cluster.py, cli.py:
* added three new parameters to renew-crypto (--new-spice-certificate,
  --spice-certificate, --spice-ca-certificate) and their validation.

utils/x509.py:
* changed GenerateSelfSignedSslCert so that now also returns the
  generated key and certificate;
* added missing return value in the docstring of
  GenerateSelfSignedX509Cert.

lib/bootstrap.py:
* changed the signatures of the relevant functions and implemented
  certificates generation/writing.

tools/cfupgrade:
* changed GenerateClusterCrypto invocation to reflect the new signature;
* added SPICE certificate names.

lib/errors.py:
* added the X509CertError class.

lib/hypervisor/hv_kvm.py:
* silenced pylint warning R0915

Signed-off-by: Andrea Spadaccini <spadaccio@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Signed-off-by: Andrea Spadaccini <spadaccio@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Commit 41e1e79e introduced a feature in which when wait_for_sync is not
set, DRBD sync is paused during the OS installation.

Doing so, however, broke OS creation's error handling: the result value
from the instance_os_add RPC call was overwritten by the one of the
blockdev_pause_resume_sync call before there was a chance for it to
be raised and thus masking possible errors in the OS creation.

Note that the wipe method, from which the pause technique was inspired,
does not suffer from this bug.

Signed-off-by: Faidon Liambotis <faidon@noc.grnet.gr>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

- hv_kvm.py: silence F0401, that is raised if pylint does not find the
  affinity module
- rlib2.py: change disable-msg to disable

Signed-off-by: Andrea Spadaccini <spadaccio@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

The MigrateInstance function does not return anything, so the relevant
lines are removed from the documentation. Instead, the raised exception
is documented.

Signed-off-by: Andrea Spadaccini <spadaccio@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>

Signed-off-by: Tsachy Shacham <tsachy@google.com>
Signed-off-by: René Nussbaumer <rn@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>

Signed-off-by: Agata Murawska <agatamurawska@google.com>
Signed-off-by: René Nussbaumer <rn@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>

This was still missing from RAPI.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: René Nussbaumer <rn@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

… to be consistent with hv_kvm

Signed-off-by: Tsachy Shacham <tsachy@google.com>
Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Tsachy Shacham <tsachy@google.com>
Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Tsachy Shacham <tsachy@google.com>
Signed-off-by: Iustin Pop <iustin@google.com>
[iustin@google.com: fixed some small code and style issues]
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Tsachy Shacham <tsachy@google.com>
Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

* devel-2.5: (33 commits)
  htools: remove dead code
  hail: don't select the primary as new secondary
  hail: add an extra safety check in relocate
  Fix RAPI documentation for gnt-instance console
  Add SPICE compression and streaming options
  Add SPICE support to gnt-instance console
  Make KVM use the QXL vga driver with SPICE
  Use a loop to check SPICE parameters dependency
  import: Fix a logic error due to missing "not"
  import: Make sure the disk_dump path is in EXPORT_DIR
  Switch other commonprefix to IsBelowDir
  utils: Introduce IsBelowDir
  Fixed a typo in gnt_cluster.py
  Added password for SPICE sessions
  Draft implementation of QMP connection
  Pylint fixes for autogenerated files
  Version bump for 2.5.0~beta3
  Makefile: Use $(LN_S) instead of “ln -s”
  Fixes to errors/warnings raised by pylint 0.24
  PEP8 for QA
  ...

Conflicts:
	Makefile.am
          - preserve both changes
	lib/rapi/rlib2.py
          - keep master version

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>

This was overlooked in the review, sorry.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Also added optional affinity Python package for CPU pinning under KVM
to the INSTALL doc.

Signed-off-by: Tsachy Shacham <tsachy@google.com>
Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

All opcodes which are not yet covered or can't with the current design
(e.g. cluster initialization) are excluded. This test is added to the
docs unittest since here the code already has access to a list of all
RAPI resources and does more checks on them.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

The RAPI and hooks documentation aren't related at all.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

By declaring all used opcodes or opcodes equivalent to the operations
executed in a resource we will be able to ensure all opcodes are covered
by RAPI (with some exceptions).

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

This will be used to verify opcodes used by RAPI.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

The tryEvac/evacuateInstance functions are no longer used in the new
multi-group world order, so we remove them and change the unit-test to
test the actual IAllocator function.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

This just adds the primary node of the instance as 'non-allocable'
during the choosing of the new secondary.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

If we select the primary as new secondary, better to fail than return
wrong data to Ganeti.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Fix a failing pyassert in the RAPI docs and update it to reflect the
addition of SPICE to gnt-instance console.

Signed-off-by: Andrea Spadaccini <spadaccio@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Add the following SPICE audio/image compression and video streaming
detection hypervisor options:

* spice_image_compression
* spice_jpeg_wan_compression
* spice_zlib_glz_wan_compression
* spice_streaming_video
* spice_playback_compression

Also add the related documentation and silence pylint R0914 warning
about too many local variables in hv_kvm._GenerateKVMRuntime.

Signed-off-by: Andrea Spadaccini <spadaccio@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Also update related unit tests.

Signed-off-by: Andrea Spadaccini <spadaccio@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Like “/”, it'll just return a JSON null.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>