Commas are not valid characters in tags, hence they can't be use to
separate the different job IDs; plus signs (+) are available, and not too
bad.

Signed-off-by: Dato Simó <dato@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

This commit clarifies one particular point of the auto-repair workflow:
what to do when multiple, conflicting administrator-set tags exist in an
object; and how tags at different levels (cluster, node group and instance)
interact.

For conflict within an object, we choose to always let the most restrictive
tag win (i.e. the least destructive repair, and the longest suspension
time). For tags at different levels, we follow a simple "nearest tag wins"
rule.

Signed-off-by: Dato Simó <dato@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

The graph added here follows the data types introduced in 7ec2f76b, by which
"Suspended" is not a state, but a possible value of the auto-repair policy.

Signed-off-by: Dato Simó <dato@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

This commit changes the "ganeti:watcher:repair:pending" and
"ganeti:watcher:repair:result" tag prefixes to use
"ganeti:watcher:autorepair:{pending,result}", so that the same prefix is
used in all cases.

Signed-off-by: Dato Simó <dato@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

This design describes a tool that will perform automatic repairs on
instances when they are detected to be unhealthy (living on offline or
drained nodes, at the moment). These repairs can be scheduled
automatically or requested as a one-off by a tool or person.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Bernardo Dal Seno <bdalseno@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>