In master, the function GenerateSelfSignedSslCert has been moved to
utils.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Conflicts:
	doc/security.rst
	  trivial
	lib/cli.py
	  trivial

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

In order not to complicate to much the _ExecuteKVMRuntime function with
nested try/except/finally/else constructs we move the actual
runcmd+check call in a separate _RunKVMCmd function.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

If this file exists, for an instance, we release the uid contained
inside back to the uid pool, at instance shutdown.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

We can't guarantee to keep the LockedObject around, when ReleaseUid is
called (because that might happen, for example, after a ganeti
shutdown/restart). So we'll support releasing on just an integer uid.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

uidpool users that get passed a LockedUid by the uidpool need to know
which one the uid is. Since it's not nice to make them access a private
member, and we shouldn't make "uid" public either, we'll add a getter
method.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Currently putting the cleanup just after the actual shutdown ensures
that it never gets called, due to how the retry/shutdown cycle works.
So we move those cleanups to their new dedicated place.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

It's a lot easier, when looking at the output, if you can search the
parameter you're looking for alphabetically.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Currently some hypervisors (namely kvm) need to do some cleanup after
making sure an instance is stopped. With the moving of the retry cycle
in backend those cleanups were never done. In order to solve this we add
a new optional hypervisor function, CleanupInstance, which gets called
at the end of the shutdown procedure, and which interested hypervisors
can implement to be sure not to miss cleanup operations.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Additionally also move to the RunWhileStopped method for the configuration merger.

Signed-off-by: René Nussbaumer <rn@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

When enabling a new hypervisor, we must ensure that we have its
parameters in the cluster (global) hvparams dictionary.

Furthermore, we add a verify check for this case (this should be better
replaced with an auto-fix?).

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Commit 5fa16422 removed the checks at sed time, but only for %.7. We
need to do it for %.8 too.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: René Nussbaumer <rn@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Fix options description in the documentation for gnt-node powercycle.

Signed-off-by: Luca Bigliardi <shammash@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Also, fix the string quoting style.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Balazs Lecz <leczb@google.com>

*.py[co] were not removed from lib/confd. Removing *.py[co]
from all directories listed in $DIRS can't hurt.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

The primary IP is not used for DRBD disks, only for the job queue and
internal commands. As such, it's trivial (with a quiet job queue) to
re-ip the node.

The patch just relaxes the checks in LUAddNode, and manual testing shows
that live instances on that node keep working, and that cluster verify
is happy afterwards.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

These RPC calls can be used to start, monitor and stop the instance data
import/export daemon.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

This backend daemon for instance import and export will be used to
transfer instance data to other machines. It is implemented in a generic
way to support different ways of data input and output. The third-party
program “socat”, which is already used by the KVM hypervisor abstraction,
is used to connect to remote machines using SSL/TLS. After starting the
child processes in a separate process group, the import/export daemon
monitors their output and updates a status file regularily. This status
file can then be read by ganeti-noded (not in this patch).

Three I/O methods are supported: Raw disk, file and script. Each of these
can be used for import and export.

Similar to daemon-util, an incomplete set of tests written in Bash is
included.

Two future enhancements are planned:
- Run parts of the command chain as a dedicated user (privilege
  separation).
- Currently users of this daemon have to poll the status file while data
  is transferred. This is inefficient and creates unnecessary delays. By
  adding “dd” into the chain and sending it SIGUSR1 regularily, we can get
  some statistics, optimize the polling frequenc and even provide the user
  with an ETA (which isn't available with all current methods to
  import/export instance data).

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

* devel-2.1:
  backend: Consolidate code opening real block device

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

* devel-2.1:
  utils: Add class to split string stream into lines
  Fix cluster behaviour with disabled file storage
  Update docstrings in tools/ and enable epydoc
  Forward-port the ganeti 2.0 cfgupgrade
  Add a new tool: sanitize-config
  Fix cfgupgrade with non-default DATA_DIR
  Improving the RAPI documentation
  Mark cluster-merge as executable
  QA: Make the rapi credential handling less involving

Conflicts:
	lib/bootstrap.py (merge cds and new file names)
	lib/cmdlib.py    (trivial, kept 2.1 version for disabled file
	                  storage)
	lib/utils.py     (trivial, new imports)
	tools/cfgupgrade (trivial, new cds parameter)

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

This will be used by the new import/export daemon to split
output by its child processes into lines.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

There are a few issues with disabled file storage:
- cluster initialization is broken by default, as it uses the 'no'
  setting which is not a valid path
- some other parts of the code require the file storage dir to be a
  valid path; we workaround by skipping such code paths when it is
  disabled

A side effect is that we abstract the storage type checks into a
separate function and add validation in RepairNodeStorage (previously a
luxi client which didn't use cli.py and submitted an invalid type would
get "storage units of type 'foo' can not be repaired").

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>

This patch updates the docstrings in tools/ (mostly in lvmstrap, which
is very very old code-base) and then enabled the tools in this directory
for 'make apidoc' too.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>