63bcea2a added file checks for import/export, but unfortunately they
were broken.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

* devel-2.1: (22 commits)
  NEWS: fix empty lines
  Fix a unittest name and docstring
  Force ssh to allocate a tty
  Fix a unittest docstring
  IsProcessAlive: retry stat() a few times
  Retry{Again,Timeout}: explain reraising
  utils.Retry: pass up timeout arguments
  Add a few Retry unittests
  Bump version for 2.1.2.1 release
  Update NEWS for Ganeti 2.1.2.1
  KVM: only export instance tags if present
  ssh.GetUserFiles: move to EnsureDirs
  Hypervisors: use utils.EnsureDirs
  backend: remove a couple of useless mkdir calls
  daemon.GenericMain: fix docstring
  jstore: use EnsureDirs, and add more constants
  Bump version for 2.1.2 release
  Update NEWS file for 2.1.2
  Add dates to the NEWS file
  RAPI QA: Test instance creation/removal via RAPI
  ...

Conflicts:
	NEWS
	  - trivial (merge NEWS entries)
	lib/backend.py
	  - trivial (master doesn't have the changed code)
	lib/constants.py
	  - trivial (merge constants, plus one s/0700/SECURE_DIR_MODE/)
	test/ganeti.utils_unittest.py
	  - trivial (name+docstring changes)

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Make sure there are exactly two empty lines between different versions
(rather than 1 or 3).

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Balazs Lecz <leczb@google.com>

The docstring has been copied by the name, but the name reports a
misspell of the function it is actually testing.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Balazs Lecz <leczb@google.com>

This is required to avoid the
"Pseudo-terminal will not be allocated because stdin is not a terminal."
ssh error message in case a Ganeti script is run non-interactively.

Signed-off-by: Balazs Lecz <leczb@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Balazs Lecz <leczb@google.com>

On multiprocessor dom0 stat() on /proc can sometimes return EINVAL.
Before giving up, we try a few times to get a consistent answer.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

If Retry has to fail with RetryTimeout, it might be useful to pass the
Retry argument to RetryTimeout, to help debugging outside the Retry
cycle. We also define a RetryTimeout.RaiseInner() helper, to re-raise an
exception passed to RetryAgain. All served with a side of unit tests.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Check that Retry actually times out, and actually retries.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

* stable-2.1:
  Bump version for 2.1.2.1 release
  Update NEWS for Ganeti 2.1.2.1
  KVM: only export instance tags if present

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Currently non-tagged instances fail starting with a TypeError.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>
Reviewed-by: Balazs Lecz <leczb@google.com>

We also create a generic SECURE_DIR_MODE constant, rather than
hardcoding 0700 in the code.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Balazs Lecz <leczb@google.com>

Swap a few os.mkdir calls with utils.EnsureDirs

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Balazs Lecz <leczb@google.com>

Those directories must exist for the node daemon to run (it's in the
node daemon's list of ensured directories) and those functions are only
called by the node daemon, so there's no point in those checks+mkdir
calls.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Balazs Lecz <leczb@google.com>

The docstring reports a wrong type for the "dirs" argument. Fixing.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Balazs Lecz <leczb@google.com>

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Balazs Lecz <leczb@google.com>

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Just for easier history digging…

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

- Add support for sending JSON-encoded body to RAPI daemon
  (required to test more complex resources)
- Expand names when testing resources against config

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

- Always check SSL certificate for validity
- Actually JSON-encode HTTP content

Signed-off-by: David Knowles <dknowles@google.com>
Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Once the import/export daemon uses separate users, the node daemon file (which
is used for intra-cluster transfers) might not be readable anymore. Always
writing it to a daemon-specific file will make this easier.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

We're using salted hashes all over the place.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

HMAC will be used in more places. Centralizing some parts can't hurt.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>

This will simplify the implementation of intra-cluster instance
exports and reduces the number of local variables in
LUExportInstance.Exec.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

* devel-2.1:
  cfgupgrade: allow working with relative paths
  Cleanup /etc/hosts during node removal
  verify cluster: check /etc/hosts consistency
  Change the migration message
  qa: enable early release during parallel burnin
  Fix pylint 0.20.0 warnings
  KVM: make tags available in KVM_NET_SCRIPT
  Remove "ssconf.CheckMasterCandidate"

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Since utils.WriteFile requires an absolute path, cfgupgrade needs to
normalize the directory it is given.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

It seems that commit d8470559 dropped the cleanup of /etc/hosts when a
node is removed from the cluster. I don't know for sure, but it seems
accidental. As long as we add it to /etc/hosts, we should clean it up
too.

The patch also adds two FIXMEs since this kind of modifications should
be done via RPC calls to the master's node daemon, not directly.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

If we are told to modify /etc/hosts, then verify its consistency during
cluster verify.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Let's remove the experimental message (the Ganeti side is stable
nowadays) and replace it with a warning about possible hypervisor
issues.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>

With this, the burnin sequence on big clusters should be (much?) faster.
The patch also fixes the parallel setting (before it was always
enabled).

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

These seem to be wrong, possibly a regression in pylint.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

This function will also be useful for inter-cluster instance
moves for verifying certificates.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>

Make instance tags available as a space-separated list during the execution of
the network setup script. This allows tag-based control of things like firewall
rules and/or networking setup.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

This function is not used anymore, so there's no point in keeping it
around.

This reverts commit 3f71b464, apart from
a one empty line conflict in ssconf.py

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

- Progress messages
- Log output on errors
- Listen timeout tests

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: René Nussbaumer <rn@google.com>