This patch does multiple documentation updates for the new framework,
all pretty straightforward.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Since this is easily configurable at run-time, we remove the
configure-time parameter. If anyone is building custom packages, then
the default can be tweaked by a one-line patch to constants.py.

Note that this also fixes the type of parameter, the default from
_autoconf.py is a string parameter. Shouldn't matter except if a cluster
run code between commit 78411c60 and this one.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

This patch adds support for global hypervisor parameters in instance
creation, instance modification, instance query and at instance load
time.

We basically prevent any query on these parameters, discard them at load
time, and do not allow their modification. Together, this should make
any such parameters go away if existing and not allowed to be added.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

The rewrite after the introduction of the daemon-util script has a
copy-paste error.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

The sort_keys argument is supported since simplejson 1.3.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Until now, Ganeti started and stopped its own daemons using custom functions.
To start, the daemon was just executed and then sent the appropriate signals to
stop it again. Init scripts would have to pay attention to the PID file and
other things.

With this patch, a new script is added (“daemon-util”, installed in
$prefix/lib/ganeti/), centralizing the starting and stopping of daemons. The
provided example init script is adjusted to use this new script. Ganeti's code
no longer calls its own init script.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

If this is enabled at configure time, we pass in different parameters to
the socat console, making it a lot more manageable.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Currently we use a static value for the socat path, or we trust the
user-provided one. With this patch we still trust any user provided
value, but if none is passed we check for socat on the machine we're
being configured on. This allows us also to check if we can or cannot
use the escape= feature in socat.

If the user has forced the path in, he can also pass --with-socat-escape
in order to force the escape functionality to be used, even if a check
is not done.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

In order to allow working with older versions of autoconf we backport
this macro, but only if it's not defined already (by autoconf itself).

This commit can be reverted after we decide support for autoconf 2.61
and below should be deprecated.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

This patch adds a check for listening on the remote port in Xen and KVM
migrations. This will be generating a single “load of migration failed”
message for KVM, but otherwise not prevent the migration. For Xen (which
has a dedicated, always listening daemon) this should not create any
problems.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Currently the migration of an instance doesn't show any error until the
end. We add two messages that show better the progress:

node1# gnt-instance migrate -f instance5
Wed Nov  4 04:04:34 2009 Migrating instance instance5
Wed Nov  4 04:04:34 2009 * checking disk consistency between source and target
Wed Nov  4 04:04:35 2009 * switching node node3 to secondary mode
Wed Nov  4 04:04:35 2009 * changing into standalone mode
Wed Nov  4 04:04:35 2009 * changing disks into dual-master mode
Wed Nov  4 04:04:40 2009 * wait until resync is done
Wed Nov  4 04:04:41 2009 * preparing node3 to accept the instance
Wed Nov  4 04:04:41 2009 * migrating instance to node3
Wed Nov  4 04:04:51 2009 Migration failed, aborting
Wed Nov  4 04:04:51 2009 * switching node node3 to secondary mode
Wed Nov  4 04:04:51 2009 * changing into standalone mode
Wed Nov  4 04:04:51 2009 * changing disks into single-master mode
Wed Nov  4 04:04:57 2009 * wait until resync is done
Failure: command execution error:
Could not migrate instance instance5: Failed to migrate instance: Failed
to migrate instance instance5: …

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

This changes KVM to use HV_MIGRATION_PORT instead of KVM_MIGRATION_PORT
and enables passing the port for Xen migrations.

Since KVM_MIGRATION_PORT is not used anymore, we stop exporting it from
constants.py.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

This parameter will replace the direct use of KVM_MIGRATION_PORT and the
implicit use of the Xen migration port.

While it doesn't make sense to change this at instance level, we don't
have any other infrastructure for cluster-wide hypervisor parameters, so
we add it here (and document that it usually shouldn't be changed on a
per-instance basis).

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Currently the $hypervisor.MigrateInstance takes the instance name. This
patch changes it to take the instance object, such that other instance
properties (especially hvparams) are available to it.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Since instances can live in different VLANs from nodes (especially in
routed mode), based on the 'link' parameter, we shouldn't always
restrict having duplicate IPs. Thus we only check the node IPs/cluster
IP for now.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Olivier Tharan <olive@google.com>

Currently a few of the LU's CheckPrereq use utils.HostInfo which raises
a resolver error in case of failure. This is an exception from the
standard that CheckPrereq should raise an OpPrereqError if the error is
in the 'pre' phase (so that it can be retried).

This patch adds a new error code (resolver_error) and a wrapper over
utils.HostInfo that just converts the ResolverError into
OpPrereqError(…, errors.ECODE_RESOLVER). It then uses this wrapper in
cmdlib, bootstrap and some scripts.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

This patch adds a check that the cluster IP, the nodes primary (and
secondary, if enabled) IP(s) and the instances NIC IPs are unique in the
cluster.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

This patch is an attempt to fix the ugly issue during migration:
  Cannot resync disks on node …: [True, 100]

If my understanding is correct, sometimes we poll the /proc/drbd file at
an inoportune moment, while it's being updated, or while the DRBD device
is changing state, and we see an unexpected state.

Based on the assumption that this is just a transient state, rather than
aborting directly, we change the backend.DrbdWaitSync() function to
retry a few times the operation, giving DRBD a chance to settle down at
the end of the resync.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>

A newer version of pylint, more warnings…

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

This reverts commit 37fc2cf5, since it
introduces configure.ac changes that depend on very very new autoconf
macros that are not present in current stable distros (and it was not
advertised as such).

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

This reverts commit ce0eb669, since it depends
on 37fc2cf5 which will be reverted too.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

This patch changes the behaviour of _WriteConfig in case of
configuration errors:

- before, it used to abort the saving (even though the in-memory
  configuration used by current jobs has already changed)
- now, we log it (both to the log and to the user) but continue, since
  we can't revert to a good version of the config anyway

This should make the internal behaviour of the code more consistent with
the external world, even though the config might be “wrong”; we leave
the cleanup to the user. This should not be as bad as it sounds, since
we haven't actually seen this case except for the ugly master candidates
handling, and that was fixed recently by Guido's patch series.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

This requires git and lockfile-progs, and only backs up config.data (see
the comments why).

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

If this is enabled at configure time, we pass in different parameters to
the socat console, making it a lot more manageable.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Currently we use a static value for the socat path, or we trust the
user-provided one. With this patch we still trust any user provided
value, but if none is passed we check for socat on the machine we're
being configured on. This allows us also to check if we can or cannot
use the escape= feature in socat.

If the user has forced the path in, he can also pass --with-socat-escape
in order to force the escape functionality to be used, even if a check
is not done.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Since ':' is not a valid character in PV names (for the way Ganeti uses
LVM), we need to check this and warn the user. This patch adds a new
NV_PVLIST cluster verify check and verifies the PV names returned from
the nodes.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

We will need to enumerate selectively the PVs of (possible) many VGs and
not only the allocatable ones. For this we make the VG selection and the
allocatable filtering optional. The two callers are modified for this
new calling syntax.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

While ':' is not actually a supporte character in PV names (it has a
special meaning for commands like lvcreate), we should throw specific
errors for this case instead of generic “Can't create LV”.

This patch does two things:

- modifies the separator used when listing PVs to be '|' such that we
  can actually parse ':' as part of PV names
- check if any of the discovered PVs have ':' in their name when
  creating LVs, and if so throw a specific error

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Also replaces a hardcoded limit of 15 seconds with 1/4
of NET_RECONFIG_TIMEOUT.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

There are quite a few retry loops with timeouts in Ganeti's
code. Duplicating code is not good, so this patch introduces
a new function named “utils.Retry” to remedy this situation.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Iustin Pop <iustin@google.com>

Currently the repair storage has two issues:

- down instances are aborting the operation, even though they should be
  ignored (it's not technically possible to know their disk status
  unless we would activate their disks)
- if the VG is so broken that disks cannot be activated via gnt-instance
  activate-disks or gnt-instance startup, it's not possible to repair
  the VG at all

The patch makes the opcode skip down instances and also introduces an
``--ignore-consistency`` flag for forcing the execution of the LU.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>