From 537d18f785edfffb7505510ef309cbd4c31bb914 Mon Sep 17 00:00:00 2001

From: Ondrej Mular <omular@redhat.com>

Date: Thu, 12 Jan 2023 14:14:26 +0100

Subject: [PATCH 1/2] add '--agent-validation' option for enabling agent

 self-validation feature

---

 pcs/cli/common/parse_args.py                  |   3 +

 pcs/lib/cib/resource/primitive.py             |  12 +-

 pcs/lib/cib/resource/remote_node.py           |   1 +

 pcs/lib/commands/booth.py                     |   1 +

 pcs/lib/commands/resource.py                  |  16 ++

 pcs/lib/commands/stonith.py                   |   8 +

 pcs/pcs.8.in                                  |  16 +-

 pcs/resource.py                               |  13 +-

 pcs/stonith.py                                |   3 +

 pcs/usage.py                                  |  31 ++--

 .../cib/resource/test_primitive_validate.py   |  49 ++++++

 .../commands/resource/test_resource_create.py | 155 ++++++++++++------

 pcs_test/tier0/lib/commands/test_booth.py     |  49 ------

 pcs_test/tier0/lib/commands/test_stonith.py   |  24 +--

 pcs_test/tier1/cib_resource/test_create.py    |   2 +

 .../tier1/cib_resource/test_stonith_create.py |   2 -

 pcs_test/tier1/legacy/test_resource.py        |   8 +-

 pcs_test/tier1/legacy/test_stonith.py         |  25 ++-

 18 files changed, 272 insertions(+), 146 deletions(-)

diff --git a/pcs/cli/common/parse_args.py b/pcs/cli/common/parse_args.py

index 0a43deec..a16d882e 100644

--- a/pcs/cli/common/parse_args.py

+++ b/pcs/cli/common/parse_args.py

@@ -94,6 +94,8 @@ PCS_LONG_OPTIONS = [

     f"{_OUTPUT_FORMAT_OPTION_STR}=",

     # auth token

     "token=",

+    # enable agent self validation

+    "agent-validation",

 ]

@@ -485,6 +487,7 @@ class InputModifiers:

             {

                 # boolean values

                 "--all": "--all" in options,

+                "--agent-validation": "--agent-validation" in options,

                 "--autodelete": "--autodelete" in options,

                 "--brief": "--brief" in options,

                 "--config": "--config" in options,

diff --git a/pcs/lib/cib/resource/primitive.py b/pcs/lib/cib/resource/primitive.py

index c5df8e58..5a6e1e0d 100644

--- a/pcs/lib/cib/resource/primitive.py

+++ b/pcs/lib/cib/resource/primitive.py

@@ -137,6 +137,7 @@ def create(

     resource_type: str = "resource",

     # TODO remove this arg

     do_not_report_instance_attribute_server_exists: bool = False,

+    enable_agent_self_validation: bool = False,

 ):

     # pylint: disable=too-many-arguments

     # pylint: disable=too-many-locals

@@ -159,6 +160,8 @@ def create(

     resource_type -- describes the resource for reports

     do_not_report_instance_attribute_server_exists -- dirty fix due to

         suboptimal architecture, TODO: fix the architecture and remove the param

+    enable_agent_self_validation -- if True, use agent self-validation feature

+        to validate instance attributes

     """

     if raw_operation_list is None:

         raw_operation_list = []

@@ -200,6 +203,7 @@ def create(

         instance_attributes,

         resources_section,

         force=allow_invalid_instance_attributes,

+        enable_agent_self_validation=enable_agent_self_validation,

     )

     # TODO remove this "if", see pcs.lib.cib.remote_node.create for details

     if do_not_report_instance_attribute_server_exists:

@@ -388,6 +392,7 @@ def validate_resource_instance_attributes_create(

     instance_attributes: Mapping[str, str],

     resources_section: _Element,

     force: bool = False,

+    enable_agent_self_validation: bool = False,

 ) -> reports.ReportItemList:

     report_items: reports.ReportItemList = []

     agent_name = resource_agent.metadata.name

@@ -419,7 +424,8 @@ def validate_resource_instance_attributes_create(

         )

     if (

-        _is_ocf_or_stonith_agent(agent_name)

+        enable_agent_self_validation

+        and _is_ocf_or_stonith_agent(agent_name)

         and resource_agent.metadata.agent_exists

         and resource_agent.metadata.provides_self_validation

         and not any(

@@ -447,6 +453,7 @@ def validate_resource_instance_attributes_update(

     resource_id: str,

     resources_section: _Element,

     force: bool = False,

+    enable_agent_self_validation: bool = False,

 ) -> reports.ReportItemList:

     # pylint: disable=too-many-locals

     # TODO This function currently accepts the updated resource as a string and

@@ -521,7 +528,8 @@ def validate_resource_instance_attributes_update(

         )

     if (

-        _is_ocf_or_stonith_agent(agent_name)

+        enable_agent_self_validation

+        and _is_ocf_or_stonith_agent(agent_name)

         and resource_agent.metadata.agent_exists

         and resource_agent.metadata.provides_self_validation

         and not any(

diff --git a/pcs/lib/cib/resource/remote_node.py b/pcs/lib/cib/resource/remote_node.py

index c76e37a6..f65c5446 100644

--- a/pcs/lib/cib/resource/remote_node.py

+++ b/pcs/lib/cib/resource/remote_node.py

@@ -253,4 +253,5 @@ def create(

         # 3) call the validation from here and handle the results or config

         #    the validator before / when running it

         do_not_report_instance_attribute_server_exists=True,

+        enable_agent_self_validation=False,

     )

diff --git a/pcs/lib/commands/booth.py b/pcs/lib/commands/booth.py

index ee91ea14..7b0ed4de 100644

--- a/pcs/lib/commands/booth.py

+++ b/pcs/lib/commands/booth.py

@@ -480,6 +480,7 @@ def create_in_cluster(

         env.cmd_runner(),

         resources_section,

         id_provider,

+        enable_agent_self_validation=False,

     )

     agent_factory = ResourceAgentFacadeFactory(

         env.cmd_runner(), report_processor

diff --git a/pcs/lib/commands/resource.py b/pcs/lib/commands/resource.py

index 28407d48..12b1f0e9 100644

--- a/pcs/lib/commands/resource.py

+++ b/pcs/lib/commands/resource.py

@@ -348,6 +348,7 @@ def create(

     ensure_disabled: bool = False,

     wait: WaitType = False,

     allow_not_suitable_command: bool = False,

+    enable_agent_self_validation: bool = False,

 ):

     # pylint: disable=too-many-arguments, too-many-locals

     """

@@ -381,6 +382,8 @@ def create(

         pcs.lib.commands.remote_node);

         in the case of remote/guest node forcible error is produced when this

         flag is set to False and warning is produced otherwise

+    enable_agent_self_validation -- if True, use agent self-validation feature

+        to validate instance attributes

     """

     runner = env.cmd_runner()

     agent_factory = ResourceAgentFacadeFactory(runner, env.report_processor)

@@ -427,6 +430,7 @@ def create(

             allow_invalid_operation,

             allow_invalid_instance_attributes,

             use_default_operations,

+            enable_agent_self_validation=enable_agent_self_validation,

         )

         if env.report_processor.has_errors:

             raise LibraryError()

@@ -451,6 +455,7 @@ def create_as_clone(

     ensure_disabled: bool = False,

     wait: WaitType = False,

     allow_not_suitable_command: bool = False,

+    enable_agent_self_validation: bool = False,

 ):

     # pylint: disable=too-many-arguments, too-many-locals

     """

@@ -478,6 +483,8 @@ def create_as_clone(

     ensure_disabled -- is flag that keeps resource in target-role "Stopped"

     wait -- is flag for controlling waiting for pacemaker idle mechanism

     allow_not_suitable_command -- turn forceable errors into warnings

+    enable_agent_self_validation -- if True, use agent self-validation feature

+        to validate instance attributes

     """

     runner = env.cmd_runner()

     agent_factory = ResourceAgentFacadeFactory(runner, env.report_processor)

@@ -531,6 +538,7 @@ def create_as_clone(

             allow_invalid_operation,

             allow_invalid_instance_attributes,

             use_default_operations,

+            enable_agent_self_validation=enable_agent_self_validation,

         )

         clone_element = resource.clone.append_new(

@@ -561,6 +569,7 @@ def create_in_group(

     put_after_adjacent: bool = False,

     wait: WaitType = False,

     allow_not_suitable_command: bool = False,

+    enable_agent_self_validation: bool = False,

 ):

     # pylint: disable=too-many-arguments, too-many-locals

     """

@@ -589,6 +598,8 @@ def create_in_group(

         adjacent resource

     wait -- is flag for controlling waiting for pacemaker idle mechanism

     allow_not_suitable_command -- turn forceable errors into warnings

+    enable_agent_self_validation -- if True, use agent self-validation feature

+        to validate instance attributes

     """

     runner = env.cmd_runner()

     agent_factory = ResourceAgentFacadeFactory(runner, env.report_processor)

@@ -664,6 +675,7 @@ def create_in_group(

             allow_invalid_operation,

             allow_invalid_instance_attributes,

             use_default_operations,

+            enable_agent_self_validation=enable_agent_self_validation,

         )

         if ensure_disabled:

             resource.common.disable(primitive_element, id_provider)

@@ -701,6 +713,7 @@ def create_into_bundle(

     wait: WaitType = False,

     allow_not_suitable_command: bool = False,

     allow_not_accessible_resource: bool = False,

+    enable_agent_self_validation: bool = False,

 ):

     # pylint: disable=too-many-arguments, too-many-locals

     """

@@ -728,6 +741,8 @@ def create_into_bundle(

     wait -- is flag for controlling waiting for pacemaker idle mechanism

     allow_not_suitable_command -- turn forceable errors into warnings

     allow_not_accessible_resource -- turn forceable errors into warnings

+    enable_agent_self_validation -- if True, use agent self-validation feature

+        to validate instance attributes

     """

     runner = env.cmd_runner()

     agent_factory = ResourceAgentFacadeFactory(runner, env.report_processor)

@@ -775,6 +790,7 @@ def create_into_bundle(

             allow_invalid_operation,

             allow_invalid_instance_attributes,

             use_default_operations,

+            enable_agent_self_validation=enable_agent_self_validation,

         )

         if ensure_disabled:

             resource.common.disable(primitive_element, id_provider)

diff --git a/pcs/lib/commands/stonith.py b/pcs/lib/commands/stonith.py

index 15b10dec..fc0264e7 100644

--- a/pcs/lib/commands/stonith.py

+++ b/pcs/lib/commands/stonith.py

@@ -117,6 +117,7 @@ def create(

     use_default_operations: bool = True,

     ensure_disabled: bool = False,

     wait: WaitType = False,

+    enable_agent_self_validation: bool = False,

 ):

     # pylint: disable=too-many-arguments, too-many-locals

     """

@@ -139,6 +140,8 @@ def create(

         operations (specified in a stonith agent)

     ensure_disabled -- flag that keeps resource in target-role "Stopped"

     wait -- flag for controlling waiting for pacemaker idle mechanism

+    enable_agent_self_validation -- if True, use agent self-validation feature

+        to validate instance attributes

     """

     runner = env.cmd_runner()

     agent_factory = ResourceAgentFacadeFactory(runner, env.report_processor)

@@ -174,6 +177,7 @@ def create(

             allow_invalid_instance_attributes=allow_invalid_instance_attributes,

             use_default_operations=use_default_operations,

             resource_type="stonith",

+            enable_agent_self_validation=enable_agent_self_validation,

         )

         if ensure_disabled:

             resource.common.disable(stonith_element, id_provider)

@@ -195,6 +199,7 @@ def create_in_group(

     adjacent_resource_id: Optional[str] = None,

     put_after_adjacent: bool = False,

     wait: WaitType = False,

+    enable_agent_self_validation: bool = False,

 ):

     # pylint: disable=too-many-arguments, too-many-locals

     """

@@ -221,6 +226,8 @@ def create_in_group(

     put_after_adjacent -- is flag to put a newly create resource befor/after

         adjacent stonith

     wait -- flag for controlling waiting for pacemaker idle mechanism

+    enable_agent_self_validation -- if True, use agent self-validation feature

+        to validate instance attributes

     """

     runner = env.cmd_runner()

     agent_factory = ResourceAgentFacadeFactory(runner, env.report_processor)

@@ -286,6 +293,7 @@ def create_in_group(

             allow_invalid_operation,

             allow_invalid_instance_attributes,

             use_default_operations,

+            enable_agent_self_validation=enable_agent_self_validation,

         )

         if ensure_disabled:

             resource.common.disable(stonith_element, id_provider)

diff --git a/pcs/pcs.8.in b/pcs/pcs.8.in

index cd00f8ac..6f7fe9cc 100644

--- a/pcs/pcs.8.in

+++ b/pcs/pcs.8.in

@@ -95,8 +95,8 @@ Show list of all available resource agents (if filter is provided then only reso

 describe [<standard>:[<provider>:]]<type> [\fB\-\-full\fR]

 Show options for the specified resource. If \fB\-\-full\fR is specified, all options including advanced and deprecated ones are shown.

 .TP

-create <resource id> [<standard>:[<provider>:]]<type> [resource options] [\fBop\fR <operation action> <operation options> [<operation action> <operation options>]...] [\fBmeta\fR <meta options>...] [\fBclone\fR [<clone id>] [<clone options>] | promotable [<clone id>] [<promotable options>] | \fB\-\-group\fR <group id> [\fB\-\-before\fR <resource id> | \fB\-\-after\fR <resource id>] | \fBbundle\fR <bundle id>] [\fB\-\-disabled\fR] [\fB\-\-no\-default\-ops] [\fB\-\-wait\fR[=n]]

-Create specified resource. If \fBclone\fR is used a clone resource is created. If \fBpromotable\fR is used a promotable clone resource is created. If \fB\-\-group\fR is specified the resource is added to the group named. You can use \fB\-\-before\fR or \fB\-\-after\fR to specify the position of the added resource relatively to some resource already existing in the group. If \fBbundle\fR is specified, resource will be created inside of the specified bundle. If \fB\-\-disabled\fR is specified the resource is not started automatically. If \fB\-\-no\-default\-ops\fR is specified, only monitor operations are created for the resource and all other operations use default settings. If \fB\-\-wait\fR is specified, pcs will wait up to 'n' seconds for the resource to start and then return 0 if the resource is started, or 1 if the resource has not yet started. If 'n' is not specified it defaults to 60 minutes.

+create <resource id> [<standard>:[<provider>:]]<type> [resource options] [\fBop\fR <operation action> <operation options> [<operation action> <operation options>]...] [\fBmeta\fR <meta options>...] [\fBclone\fR [<clone id>] [<clone options>] | promotable [<clone id>] [<promotable options>] | \fB\-\-group\fR <group id> [\fB\-\-before\fR <resource id> | \fB\-\-after\fR <resource id>] | \fBbundle\fR <bundle id>] [\fB\-\-disabled\fR] [\fB\-\-agent\-validation\fR] [\fB\-\-no\-default\-ops\fR] [\fB\-\-wait\fR[=n]]

+Create specified resource. If \fBclone\fR is used a clone resource is created. If \fBpromotable\fR is used a promotable clone resource is created. If \fB\-\-group\fR is specified the resource is added to the group named. You can use \fB\-\-before\fR or \fB\-\-after\fR to specify the position of the added resource relatively to some resource already existing in the group. If \fBbundle\fR is specified, resource will be created inside of the specified bundle. If \fB\-\-disabled\fR is specified the resource is not started automatically. If \fB\-\-agent\-validation\fR is specified, resource agent validate\-all action will be used to validate resource options. If \fB\-\-no\-default\-ops\fR is specified, only monitor operations are created for the resource and all other operations use default settings. If \fB\-\-wait\fR is specified, pcs will wait up to 'n' seconds for the resource to start and then return 0 if the resource is started, or 1 if the resource has not yet started. If 'n' is not specified it defaults to 60 minutes.

 Example: Create a new resource called 'VirtualIP' with IP address 192.168.0.99, netmask of 32, monitored everything 30 seconds, on eth2: pcs resource create VirtualIP ocf:heartbeat:IPaddr2 ip=192.168.0.99 cidr_netmask=32 nic=eth2 op monitor interval=30s

 .TP

@@ -183,11 +183,13 @@ List available OCF resource agent providers.

 agents [standard[:provider]]

 List available agents optionally filtered by standard and provider.

 .TP

-update <resource id> [resource options] [op [<operation action> <operation options>]...] [meta <meta operations>...] [\fB\-\-wait\fR[=n]]

+update <resource id> [resource options] [op [<operation action> <operation options>]...] [meta <meta operations>...] [\fB\-\-agent\-validation\fR] [\fB\-\-wait\fR[=n]]

 Add, remove or change options of specified resource, clone or multi\-state resource. Unspecified options will be kept unchanged. If you wish to remove an option, set it to empty value, i.e. 'option_name='.

 If an operation (op) is specified it will update the first found operation with the same action on the specified resource. If no operation with that action exists then a new operation will be created. (WARNING: all existing options on the updated operation will be reset if not specified.) If you want to create multiple monitor operations you should use the 'op add' & 'op remove' commands.

+If \fB\-\-agent\-validation\fR is specified, resource agent validate\-all action will be used to validate resource options.

+

 If \fB\-\-wait\fR is specified, pcs will wait up to 'n' seconds for the changes to take effect and then return 0 if the changes have been processed or 1 otherwise. If 'n' is not specified it defaults to 60 minutes.

 .TP

 op add <resource id> <operation action> [operation properties]

@@ -670,8 +672,8 @@ Show list of all available stonith agents (if filter is provided then only stoni

 describe <stonith agent> [\fB\-\-full\fR]

 Show options for specified stonith agent. If \fB\-\-full\fR is specified, all options including advanced and deprecated ones are shown.

 .TP

-create <stonith id> <stonith device type> [stonith device options] [op <operation action> <operation options> [<operation action> <operation options>]...] [meta <meta options>...] [\fB\-\-group\fR <group id> [\fB\-\-before\fR <stonith id> | \fB\-\-after\fR <stonith id>]] [\fB\-\-disabled\fR] [\fB\-\-wait\fR[=n]]

-Create stonith device with specified type and options. If \fB\-\-group\fR is specified the stonith device is added to the group named. You can use \fB\-\-before\fR or \fB\-\-after\fR to specify the position of the added stonith device relatively to some stonith device already existing in the group. If\fB\-\-disabled\fR is specified the stonith device is not used. If \fB\-\-wait\fR is specified, pcs will wait up to 'n' seconds for the stonith device to start and then return 0 if the stonith device is started, or 1 if the stonith device has not yet started. If 'n' is not specified it defaults to 60 minutes.

+create <stonith id> <stonith device type> [stonith device options] [op <operation action> <operation options> [<operation action> <operation options>]...] [meta <meta options>...] [\fB\-\-group\fR <group id> [\fB\-\-before\fR <stonith id> | \fB\-\-after\fR <stonith id>]] [\fB\-\-disabled\fR] [\fB\-\-agent\-validation\fR] [\fB\-\-wait\fR[=n]]

+Create stonith device with specified type and options. If \fB\-\-group\fR is specified the stonith device is added to the group named. You can use \fB\-\-before\fR or \fB\-\-after\fR to specify the position of the added stonith device relatively to some stonith device already existing in the group. If\fB\-\-disabled\fR is specified the stonith device is not used. If \fB\-\-agent\-validation\fR is specified, stonith agent validate\-all action will be used to validate stonith device options. If \fB\-\-wait\fR is specified, pcs will wait up to 'n' seconds for the stonith device to start and then return 0 if the stonith device is started, or 1 if the stonith device has not yet started. If 'n' is not specified it defaults to 60 minutes.

 Example: Create a device for nodes node1 and node2

 .br

@@ -681,8 +683,10 @@ Example: Use port p1 for node n1 and ports p2 and p3 for node n2

 .br

 pcs stonith create MyFence fence_virt 'pcmk_host_map=n1:p1;n2:p2,p3'

 .TP

-update <stonith id> [stonith device options]

+update <stonith id> [stonith device options] [\fB\-\-agent\-validation\fR]

 Add, remove or change options of specified stonith id. Unspecified options will be kept unchanged. If you wish to remove an option, set it to empty value, i.e. 'option_name='.

+

+If \fB\-\-agent\-validation\fR is specified, stonith agent validate\-all action will be used to validate stonith device options.

 .TP

 update\-scsi\-devices <stonith id> (set <device\-path> [<device\-path>...]) | (add <device\-path> [<device\-path>...] delete|remove <device\-path> [<device\-path>...] )

 Update scsi fencing devices without affecting other resources. You must specify either list of set devices or at least one device for add or delete/remove devices. Stonith resource must be running on one cluster node. Each device will be unfenced on each cluster node running cluster. Supported fence agents: fence_scsi, fence_mpath.

diff --git a/pcs/resource.py b/pcs/resource.py

index bf34e8d7..7500b37e 100644

--- a/pcs/resource.py

+++ b/pcs/resource.py

@@ -580,6 +580,7 @@ def _format_desc(indentation, desc):

 def resource_create(lib, argv, modifiers):

     """

     Options:

+      * --agent-validation - use agent self validation of instance attributes

       * --before - specified resource inside a group before which new resource

         will be placed inside the group

       * --after - specified resource inside a group after which new resource

@@ -593,6 +594,7 @@ def resource_create(lib, argv, modifiers):

       * -f - CIB file

     """

     modifiers.ensure_only_supported(

+        "--agent-validation",

         "--before",

         "--after",

         "--group",

@@ -655,6 +657,7 @@ def resource_create(lib, argv, modifiers):

         use_default_operations=not modifiers.get("--no-default-ops"),

         wait=modifiers.get("--wait"),

         allow_not_suitable_command=modifiers.get("--force"),

+        enable_agent_self_validation=modifiers.get("--agent-validation"),

     )

     clone_id = parts.get("clone_id", None)

@@ -894,12 +897,15 @@ def resource_update(lib, args, modifiers, deal_with_guest_change=True):

     """

     Options:

       * -f - CIB file

+      * --agent-validation - use agent self validation of instance attributes

       * --wait

       * --force - allow invalid options, do not fail if not possible to get

         agent metadata, allow not suitable command

     """

     del lib

-    modifiers.ensure_only_supported("-f", "--wait", "--force")

+    modifiers.ensure_only_supported(

+        "-f", "--wait", "--force", "--agent-validation"

+    )

     if len(args) < 2:

         raise CmdLineInputError()

     res_id = args.pop(0)

@@ -970,7 +976,10 @@ def resource_update(lib, args, modifiers, deal_with_guest_change=True):

             dict(params),

             res_id,

             get_resources(lib_pacemaker.get_cib(cib_xml)),

-            force=modifiers.get("--force"),

+            force=bool(modifiers.get("--force")),

+            enable_agent_self_validation=bool(

+                modifiers.get("--agent-validation")

+            ),

         )

         if report_list:

             process_library_reports(report_list)

diff --git a/pcs/stonith.py b/pcs/stonith.py

index 58cd14fc..17ba6aca 100644

--- a/pcs/stonith.py

+++ b/pcs/stonith.py

@@ -127,6 +127,7 @@ def stonith_create(lib, argv, modifiers):

         instance attributes

       * --disabled - created resource will be disabled

       * --no-default-ops - do not add default operations

+      * --agent-validation - use agent self validation of instance attributes

       * --wait

       * -f - CIB file

     """

@@ -137,6 +138,7 @@ def stonith_create(lib, argv, modifiers):

         "--force",

         "--disabled",

         "--no-default-ops",

+        "--agent-validation",

         "--wait",

         "-f",

     )

@@ -170,6 +172,7 @@ def stonith_create(lib, argv, modifiers):

         ensure_disabled=modifiers.get("--disabled"),

         use_default_operations=not modifiers.get("--no-default-ops"),

         wait=modifiers.get("--wait"),

+        enable_agent_self_validation=modifiers.get("--agent-validation"),

     )

     if not modifiers.get("--group"):

diff --git a/pcs/usage.py b/pcs/usage.py

index 0a6ffcb6..bb5f864d 100644

--- a/pcs/usage.py

+++ b/pcs/usage.py

@@ -357,7 +357,8 @@ Commands:

            [clone [<clone id>] [<clone options>] |

            promotable [<clone id>] [<promotable options>] |

            --group <group id> [--before <resource id> | --after <resource id>] |

-           bundle <bundle id>] [--disabled] [--no-default-ops] [--wait[=n]]

+           bundle <bundle id>] [--disabled] [--agent-validation]

+           [--no-default-ops] [--wait[=n]]

         Create specified resource. If clone is used a clone resource is

         created. If promotable is used a promotable clone resource is created.

         If --group is specified the resource is added to the group named. You

@@ -365,12 +366,13 @@ Commands:

         resource relatively to some resource already existing in the group. If

         bundle is used, the resource will be created inside of the specified

         bundle. If --disabled is specified the resource is not started

-        automatically. If --no-default-ops is specified, only monitor

-        operations are created for the resource and all other operations use

-        default settings. If --wait is specified, pcs will wait up to 'n'

-        seconds for the resource to start and then return 0 if the resource is

-        started, or 1 if the resource has not yet started. If 'n' is not

-        specified it defaults to 60 minutes.

+        automatically. If --agent-validation is specified, resource agent

+        validate-all action will be used to validate resource options. If

+        --no-default-ops is specified, only monitor operations are created for

+        the resource and all other operations use default settings. If --wait

+        is specified, pcs will wait up to 'n' seconds for the resource to start

+        and then return 0 if the resource is started, or 1 if the resource has

+        not yet started. If 'n' is not specified it defaults to 60 minutes.

         Example: Create a new resource called 'VirtualIP' with IP address

             192.168.0.99, netmask of 32, monitored everything 30 seconds,

             on eth2:

@@ -545,7 +547,8 @@ Commands:

         List available agents optionally filtered by standard and provider.

     update <resource id> [resource options] [op [<operation action>

-           <operation options>]...] [meta <meta operations>...] [--wait[=n]]

+           <operation options>]...] [meta <meta operations>...]

+           [--agent-validation] [--wait[=n]]

         Add, remove or change options of specified resource, clone or

         multi-state resource. Unspecified options will be kept unchanged. If

         you wish to remove an option, set it to empty value, i.e.

@@ -558,6 +561,9 @@ Commands:

         if not specified.) If you want to create multiple monitor operations

         you should use the 'op add' & 'op remove' commands.

+        If --agent-validation is specified, resource agent validate-all action

+        will be used to validate resource options.

+

         If --wait is specified, pcs will wait up to 'n' seconds for the changes

         to take effect and then return 0 if the changes have been processed or

         1 otherwise. If 'n' is not specified it defaults to 60 minutes.

@@ -1420,13 +1426,15 @@ Commands:

            [op <operation action> <operation options> [<operation action>

            <operation options>]...] [meta <meta options>...]

            [--group <group id> [--before <stonith id> | --after <stonith id>]]

-           [--disabled] [--wait[=n]]

+           [--disabled] [--agent-validation] [--wait[=n]]

         Create stonith device with specified type and options.

         If --group is specified the stonith device is added to the group named.

         You can use --before or --after to specify the position of the added

         stonith device relatively to some stonith device already existing in the

         group.

         If --disabled is specified the stonith device is not used.

+        If --agent-validation is specified, stonith agent validate-all action

+        will be used to validate stonith device options.

         If --wait is specified, pcs will wait up to 'n' seconds for the stonith

         device to start and then return 0 if the stonith device is started, or 1

         if the stonith device has not yet started.  If 'n' is not specified it

@@ -1436,11 +1444,14 @@ Commands:

         Example: Use port p1 for node n1 and ports p2 and p3 for node n2

             pcs stonith create MyFence fence_virt 'pcmk_host_map=n1:p1;n2:p2,p3'

-    update <stonith id> [stonith device options]

+    update <stonith id> [stonith device options] [--agent-validation]

         Add, remove or change options of specified stonith id. Unspecified

         options will be kept unchanged. If you wish to remove an option, set it

         to empty value, i.e. 'option_name='.

+        If --agent-validation is specified, stonith agent validate-all action

+        will be used to validate stonith device options.

+

     update-scsi-devices <stonith id> (set <device-path> [<device-path>...])

             | (add <device-path> [<device-path>...] delete|remove <device-path>

             [device-path>...])

diff --git a/pcs_test/tier0/lib/cib/resource/test_primitive_validate.py b/pcs_test/tier0/lib/cib/resource/test_primitive_validate.py

index 1bc3a5a6..0456abcf 100644

--- a/pcs_test/tier0/lib/cib/resource/test_primitive_validate.py

+++ b/pcs_test/tier0/lib/cib/resource/test_primitive_validate.py

@@ -592,6 +592,22 @@ class ValidateResourceInstanceAttributesCreateSelfValidation(TestCase):

         self.agent_self_validation_mock.return_value = True, []

         self.cmd_runner = mock.Mock()

+    def test_disabled(self):

+        attributes = {"required": "value"}

+        facade = _fixture_ocf_agent()

+        self.assertEqual(

+            primitive.validate_resource_instance_attributes_create(

+                self.cmd_runner,

+                facade,

+                attributes,

+                etree.Element("resources"),

+                force=False,

+                enable_agent_self_validation=False,

+            ),

+            [],

+        )

+        self.agent_self_validation_mock.assert_not_called()

+

     def test_success(self):

         attributes = {"required": "value"}

         facade = _fixture_ocf_agent()

@@ -602,6 +618,7 @@ class ValidateResourceInstanceAttributesCreateSelfValidation(TestCase):

                 attributes,

                 etree.Element("resources"),

                 force=False,

+                enable_agent_self_validation=True,

             ),

             [],

         )

@@ -621,6 +638,7 @@ class ValidateResourceInstanceAttributesCreateSelfValidation(TestCase):

                 attributes,

                 etree.Element("resources"),

                 force=True,

+                enable_agent_self_validation=True,

             ),

             [],

         )

@@ -642,6 +660,7 @@ class ValidateResourceInstanceAttributesCreateSelfValidation(TestCase):

                 attributes,

                 etree.Element("resources"),

                 force=False,

+                enable_agent_self_validation=True,

             ),

             [

                 fixture.error(

@@ -667,6 +686,7 @@ class ValidateResourceInstanceAttributesCreateSelfValidation(TestCase):

                 attributes,

                 etree.Element("resources"),

                 force=False,

+                enable_agent_self_validation=True,

             ),

             [],

         )

@@ -686,6 +706,7 @@ class ValidateResourceInstanceAttributesCreateSelfValidation(TestCase):

                 attributes,

                 etree.Element("resources"),

                 force=False,

+                enable_agent_self_validation=True,

             ),

             [],

         )

@@ -701,6 +722,7 @@ class ValidateResourceInstanceAttributesCreateSelfValidation(TestCase):

                 attributes,

                 etree.Element("resources"),

                 force=False,

+                enable_agent_self_validation=True,

             ),

             [],

         )

@@ -716,6 +738,7 @@ class ValidateResourceInstanceAttributesCreateSelfValidation(TestCase):

                 attributes,

                 etree.Element("resources"),

                 force=False,

+                enable_agent_self_validation=True,

             ),

             [

                 fixture.error(

@@ -1275,6 +1298,24 @@ class ValidateResourceInstanceAttributesUpdateSelfValidation(TestCase):

             etree.SubElement(nvset_el, "nvpair", dict(name=name, value=value))

         return resources_el

+    def test_disabled(self):

+        old_attributes = {"required": "old_value"}

+        new_attributes = {"required": "new_value"}

+        facade = _fixture_ocf_agent()

+        self.assertEqual(

+            primitive.validate_resource_instance_attributes_update(

+                self.cmd_runner,

+                facade,

+                new_attributes,

+                self._NAME,

+                self._fixture_resources(old_attributes),

+                force=False,

+                enable_agent_self_validation=False,

+            ),

+            [],

+        )

+        self.agent_self_validation_mock.assert_not_called()

+

     def test_success(self):

         old_attributes = {"required": "old_value"}

         new_attributes = {"required": "new_value"}

@@ -1287,6 +1328,7 @@ class ValidateResourceInstanceAttributesUpdateSelfValidation(TestCase):

                 self._NAME,

                 self._fixture_resources(old_attributes),

                 force=False,

+                enable_agent_self_validation=True,

             ),

             [],

         )

@@ -1318,6 +1360,7 @@ class ValidateResourceInstanceAttributesUpdateSelfValidation(TestCase):

                 self._NAME,

                 self._fixture_resources(old_attributes),

                 force=True,

+                enable_agent_self_validation=True,

             ),

             [],

         )

@@ -1354,6 +1397,7 @@ class ValidateResourceInstanceAttributesUpdateSelfValidation(TestCase):

                 self._NAME,

                 self._fixture_resources(old_attributes),

                 force=False,

+                enable_agent_self_validation=True,

             ),

             [

                 fixture.error(

@@ -1391,6 +1435,7 @@ class ValidateResourceInstanceAttributesUpdateSelfValidation(TestCase):

                 self._NAME,

                 self._fixture_resources(old_attributes),

                 force=False,

+                enable_agent_self_validation=True,

             ),

             [],

         )

@@ -1422,6 +1467,7 @@ class ValidateResourceInstanceAttributesUpdateSelfValidation(TestCase):

                 self._NAME,

                 self._fixture_resources(old_attributes),

                 force=False,

+                enable_agent_self_validation=True,

             ),

             [],

         )

@@ -1439,6 +1485,7 @@ class ValidateResourceInstanceAttributesUpdateSelfValidation(TestCase):

                 self._NAME,

                 self._fixture_resources(old_attributes),

                 force=False,

+                enable_agent_self_validation=True,

             ),

             [],

         )

@@ -1456,6 +1503,7 @@ class ValidateResourceInstanceAttributesUpdateSelfValidation(TestCase):

                 self._NAME,

                 self._fixture_resources(old_attributes),

                 force=False,

+                enable_agent_self_validation=True,

             ),

             [

                 fixture.error(

@@ -1482,6 +1530,7 @@ class ValidateResourceInstanceAttributesUpdateSelfValidation(TestCase):

                 self._NAME,

                 self._fixture_resources(old_attributes),

                 force=False,

+                enable_agent_self_validation=True,

             ),

             [

                 fixture.warn(

diff --git a/pcs_test/tier0/lib/commands/resource/test_resource_create.py b/pcs_test/tier0/lib/commands/resource/test_resource_create.py

index 3384a674..225bb57b 100644

--- a/pcs_test/tier0/lib/commands/resource/test_resource_create.py

+++ b/pcs_test/tier0/lib/commands/resource/test_resource_create.py

@@ -29,7 +29,9 @@ def create(

     allow_invalid_operation=False,

     agent_name="ocf:heartbeat:Dummy",

     allow_invalid_instance_attributes=False,

+    enable_agent_self_validation=False,

 ):

+    # pylint: disable=too-many-arguments

     return resource.create(

         env,

         "A",

@@ -41,6 +43,7 @@ def create(

         ensure_disabled=disabled,

         allow_invalid_operation=allow_invalid_operation,

         allow_invalid_instance_attributes=allow_invalid_instance_attributes,

+        enable_agent_self_validation=enable_agent_self_validation,

     )

@@ -50,6 +53,7 @@ def create_group(

     disabled=False,

     meta_attributes=None,

     operation_list=None,

+    enable_agent_self_validation=False,

 ):

     return resource.create_in_group(