Currently it has lots for duplicated code, and internal retries.
Clean it up with the following assumptions:

We'll probably be called more than once.
It is ok to fail to stop, unless we're called with force=True.
If we're called only once, and with force=True it's ok not to run the
chroot "cleanup" script (it's a destroy after all, why should chroots
have more chances than other instances?).

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

Since we know StopInstance is going to be called more than once (at
least twice, once with force and once without, but normally quite a lot
more) we don't need our own sleep/loop, and we can just send one monitor
command per call.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

1) unhardcode the timeout, abstracting it in a constant
2) Use time.time() rather than hiding the timeout in a range()
3) call hyper.StopInstance multiple times
   -- currently all hypervisors just ignore all calls but once
4) Use hyper.ListInstances() rather than GetInstanceList([hv_name])
   -- it's cheaper :)
5) Change the final message to "forcing" from "using destroy"

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

It reflects the "current" two minutes we give to the instance.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Currently some hypervisors need the stop operations to be retried more
than once, while other ones only do it in one pass. With this change
we'll handle retries outside the hypervisor code, but telling whether
this is the first try or not.

Since this option is not used for now, all hypervisors just return if
called with retry set to on, maintaining the old behavior. Since the
fake hypervisor has an idempotent StopInstance call, we avoid returning
in that case.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

- We never remember to use it (5 uses vs 21 " ,".join())
- It's longer to write than " ,".join()
- The added value of the apostrophe in the string is not very much

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

If we have only one node, instance moves fail, because it tries to move
the instance to itself. Skipping the operation, because in that case it
doesn't make sense.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Since DNS cannot contain two names with different cases anyway, this
should be ok.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Now featuring unit testing, and more deterministic results on some
corner cases.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

This should prevent typos in aliases from going unnoticed.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

If an OS supports variants, unless --force-variant is specified a valid
variant must be passed.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

Passing this option makes an undeclared variant be passed to the os "as
is", hoping it'll be able to figure it out (as per the design doc).

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

These two opcode need to know whether an unknown variant must be forced
through or not.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

List of OSes are displayed by gnt-os list, rapi, and gnt-instance
reinstall --select-os, and checked by burnin. In all of these show the
list with name+variant, if the os has variants.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

We already show the per-node os variants, also show the global ones.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

Given an os and its variants, return a list of "full" os names.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

If selected this field will contain a list of os variants supported on
all nodes.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

When we load an OS from disk, we need _TryOSFromDisk to get the real
name, without any variant. This allows any functionality that uses the
instance OS to handle a name with a variant.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

According to the design on api_version >= 15 the OS variant is the part
of the OS name after the "+" sign. If none is found, we just pass in the
first variant an OS declares (which is bound to exist, as we check for
it in _TryOSFromDisk).

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

Adding the file name to the os_files dict will fill in the full path and
get it checked, if present we also read it and split into lines, one per
declared variant.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

The slot will contain a list of variants, and the variants file constant
contains the file in the os dir which is supposed to hold the list.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

Currently all checked files in the loop are os scripts, so nothing will
change, but in the future we only want the +x bit on actual os scripts,
not necessarily all files.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

We'll be using this dict/loop to check more than just scripts, so we're
renaming the variables appropriately.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

Since nobody ever read the actual OS object, this bug was introduced in
the rpc conversion.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

This patch adds three optional parameters:
  - 'use_bootloader', whether use or not the bootloader
  - 'bootloader_path', absolute path to the bootloader
  - 'bootloader_args', extra arguments to the bootloader

Syntax:
  gnt-cluster modify --hypervisor-parameters \
    xen-pvm:bootloader_path=/usr/bin/pygrub,use_bootloader=False
  gnt-instance modify -H use_bootloader=True instance1.example.com

If use_bootloader is True, each domU can boot with its own kernel
instead of using the dom0 kernel.

Signed-off-by: Jun Futagawa <jfut@integ.jp>
Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: ultortter

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

There were more race conditions. By adding a notify function to
SharedLock.acquire we can prevent them.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

If we're de-offlining or de-draining a node we need to promote it to MC
if we have not enough, or the config will be corrupt.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

During node add we decide whether to self promote to an MC. Abstract
this decision making to a separate function.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

Currently during a master candidate removal, when it's possible to
promote another node, the removal operation fails because of a corrupt
config before it's even possible to do the promotion. Fixing this by
doing the promotion before, excluding the current node.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

If --force is used to demote an MC, but then there are not enough MCs in
the cluster, the configuration gets corrupted until a node is promoted.

In order to avoid that we only allow demotion with --force if the node
is offlined or drained at the same time, and we don't have any other
node available to promote.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

Other than returning the current number of candidates, and the number of
desired and possible candidates, we also return the maximum possible
number, even if greater than our desires. All callers for now ignore
this third value.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

With this patch we simplify usage on the SingleActionCondition (which
wasn't a condition at all) by making it a real condition. This way we
can just wait() on it, or notifyAll() as we would on a normal one. The
only catch is that notifyAll can be called only once, and wait can only
be called before notifyAll has, but luckily our PipeCondition, now quite
simplified, takes care of this, by providing a new SingleActionCondition
each time the previous one has been notified.

No Start/StopUsing function are needed anymore, and thus the condition
is a lot more robust, and there's no way file descriptors can be left
open, as they are closed in a finally block, in the same function where
they were opened, by the last thread exiting the class.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>