Blame SOURCES/nova-compute-wait-NovaEvacuate.patch

a142ce
diff --color -uNr a/doc/man/Makefile.am b/doc/man/Makefile.am
a142ce
--- a/doc/man/Makefile.am	2021-08-25 09:31:14.033615965 +0200
a142ce
+++ b/doc/man/Makefile.am	2021-08-24 17:59:40.679372762 +0200
a142ce
@@ -97,6 +97,8 @@
b4b3ce
                           ocf_heartbeat_ManageRAID.7 \
b4b3ce
                           ocf_heartbeat_ManageVE.7 \
b4b3ce
                           ocf_heartbeat_NodeUtilization.7 \
b4b3ce
+                          ocf_heartbeat_nova-compute-wait.7 \
b4b3ce
+                          ocf_heartbeat_NovaEvacuate.7 \
b4b3ce
                           ocf_heartbeat_Pure-FTPd.7 \
b4b3ce
                           ocf_heartbeat_Raid1.7 \
b4b3ce
                           ocf_heartbeat_Route.7 \
a142ce
diff --color -uNr a/heartbeat/Makefile.am b/heartbeat/Makefile.am
a142ce
--- a/heartbeat/Makefile.am	2021-08-25 09:31:14.034615967 +0200
a142ce
+++ b/heartbeat/Makefile.am	2021-08-24 17:59:40.679372762 +0200
b4b3ce
@@ -29,6 +29,8 @@
b4b3ce
 
b4b3ce
 ocfdir		        = $(OCF_RA_DIR_PREFIX)/heartbeat
b4b3ce
 
b4b3ce
+ospdir			= $(OCF_RA_DIR_PREFIX)/openstack
b4b3ce
+
b4b3ce
 dtddir			= $(datadir)/$(PACKAGE_NAME)
b4b3ce
 dtd_DATA		= ra-api-1.dtd metadata.rng
b4b3ce
 
b4b3ce
@@ -50,6 +52,9 @@
a142ce
 send_ua_SOURCES         = send_ua.c IPv6addr_utils.c
b4b3ce
 send_ua_LDADD           = $(LIBNETLIBS)
b4b3ce
 
b4b3ce
+osp_SCRIPTS	     =  nova-compute-wait	\
b4b3ce
+			NovaEvacuate
b4b3ce
+
a142ce
 ocf_SCRIPTS	      = AoEtarget		\
b4b3ce
 			AudibleAlarm		\
b4b3ce
 			ClusterMon		\
a142ce
diff --color -uNr a/heartbeat/nova-compute-wait b/heartbeat/nova-compute-wait
b4b3ce
--- a/heartbeat/nova-compute-wait	1970-01-01 01:00:00.000000000 +0100
a142ce
+++ b/heartbeat/nova-compute-wait	2021-08-24 17:59:40.678372759 +0200
b4b3ce
@@ -0,0 +1,317 @@
b4b3ce
+#!/bin/sh
b4b3ce
+# Copyright 2015 Red Hat, Inc.
b4b3ce
+#
b4b3ce
+# Description:  Manages compute daemons
b4b3ce
+#
b4b3ce
+# Authors: Andrew Beekhof
b4b3ce
+#
b4b3ce
+# Support:      openstack@lists.openstack.org
b4b3ce
+# License:      Apache Software License (ASL) 2.0
b4b3ce
+#
b4b3ce
+
b4b3ce
+
b4b3ce
+#######################################################################
b4b3ce
+# Initialization:
b4b3ce
+
b4b3ce
+###
b4b3ce
+: ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}
b4b3ce
+. ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs
b4b3ce
+###
b4b3ce
+
b4b3ce
+: ${__OCF_ACTION=$1}
b4b3ce
+
b4b3ce
+#######################################################################
b4b3ce
+
b4b3ce
+meta_data() {
b4b3ce
+	cat <
b4b3ce
+
b4b3ce
+
b4b3ce
+<resource-agent name="nova-compute-wait" version="1.0">
b4b3ce
+<version>1.0</version>
b4b3ce
+
b4b3ce
+<longdesc lang="en">
b4b3ce
+OpenStack Nova Compute Server.
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">OpenStack Nova Compute Server</shortdesc>
b4b3ce
+
b4b3ce
+<parameters>
b4b3ce
+
b4b3ce
+<parameter name="auth_url" unique="0" required="1">
b4b3ce
+<longdesc lang="en">Deprecated - do not use anymore.</longdesc>
b4b3ce
+<shortdesc lang="en">Deprecated - do not use anymore</shortdesc>
b4b3ce
+<content type="string" default="" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="username" unique="0" required="1">
b4b3ce
+<longdesc lang="en">Deprecated - do not use anymore.</longdesc>
b4b3ce
+<shortdesc lang="en">Deprecated - do not use anymore</shortdesc>
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="password" unique="0" required="1">
b4b3ce
+<longdesc lang="en">Deprecated - do not use anymore.</longdesc>
b4b3ce
+<shortdesc lang="en">Deprecated - do not use anymore</shortdesc>
b4b3ce
+<content type="string" default="" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="tenant_name" unique="0" required="1">
b4b3ce
+<longdesc lang="en">Deprecated - do not use anymore.</longdesc>
b4b3ce
+<shortdesc lang="en">Deprecated - do not use anymore</shortdesc>
b4b3ce
+<content type="string" default="" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="domain" unique="0" required="0">
b4b3ce
+<longdesc lang="en">
b4b3ce
+DNS domain in which hosts live, useful when the cluster uses short names and nova uses FQDN
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">DNS domain</shortdesc>
b4b3ce
+<content type="string" default="" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="endpoint_type" unique="0" required="0">
b4b3ce
+<longdesc lang="en">Deprecated - do not use anymore.</longdesc>
b4b3ce
+<shortdesc lang="en">Deprecated - do not use anymore</shortdesc>
b4b3ce
+<content type="string" default="" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="no_shared_storage" unique="0" required="0">
b4b3ce
+<longdesc lang="en">Deprecated - do not use anymore.</longdesc>
b4b3ce
+<shortdesc lang="en">Deprecated - do not use anymore</shortdesc>
b4b3ce
+<content type="boolean" default="0" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="evacuation_delay" unique="0" required="0">
b4b3ce
+<longdesc lang="en">
b4b3ce
+How long to wait for nova to finish evacuating instances elsewhere
b4b3ce
+before starting nova-compute.  Only used when the agent detects
b4b3ce
+evacuations might be in progress.
b4b3ce
+
b4b3ce
+You may need to increase the start timeout when increasing this value.
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">Delay to allow evacuations time to complete</shortdesc>
b4b3ce
+<content type="integer" default="120" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+</parameters>
b4b3ce
+
b4b3ce
+<actions>
b4b3ce
+<action name="start"        timeout="600" />
b4b3ce
+<action name="stop"         timeout="300" />
b4b3ce
+<action name="monitor"      timeout="20" interval="10" depth="0"/>
b4b3ce
+<action name="validate-all" timeout="20" />
b4b3ce
+<action name="meta-data"    timeout="5" />
b4b3ce
+</actions>
b4b3ce
+</resource-agent>
b4b3ce
+END
b4b3ce
+}
b4b3ce
+
b4b3ce
+#######################################################################
b4b3ce
+
b4b3ce
+# don't exit on TERM, to test that lrmd makes sure that we do exit
b4b3ce
+trap sigterm_handler TERM
b4b3ce
+sigterm_handler() {
b4b3ce
+	ocf_log info "They use TERM to bring us down. No such luck."
b4b3ce
+	return
b4b3ce
+}
b4b3ce
+
b4b3ce
+nova_usage() {
b4b3ce
+	cat <
b4b3ce
+usage: $0 {start|stop|monitor|validate-all|meta-data}
b4b3ce
+
b4b3ce
+Expects to have a fully populated OCF RA-compliant environment set.
b4b3ce
+END
b4b3ce
+}
b4b3ce
+
b4b3ce
+nova_start() {
b4b3ce
+    build_unfence_overlay
b4b3ce
+
b4b3ce
+    state=$(attrd_updater -p -n evacuate -N ${NOVA_HOST} | sed -e 's/.*value=//' | tr -d '"' )
b4b3ce
+    if [ "x$state" = x ]; then
b4b3ce
+	: never been fenced
b4b3ce
+
b4b3ce
+    elif [ "x$state" = xno ]; then
b4b3ce
+	: has been evacuated, however it could have been 1s ago
b4b3ce
+	ocf_log info "Pausing to give evacuations from ${NOVA_HOST} time to complete"
b4b3ce
+	sleep ${OCF_RESKEY_evacuation_delay}
b4b3ce
+
b4b3ce
+    else
b4b3ce
+	while [ "x$state" != "xno" ]; do
b4b3ce
+	    ocf_log info "Waiting for pending evacuations from ${NOVA_HOST}"
b4b3ce
+	    state=$(attrd_updater -p -n evacuate -N ${NOVA_HOST} | sed -e 's/.*value=//' | tr -d '"' )
b4b3ce
+	    sleep 5
b4b3ce
+	done
b4b3ce
+
b4b3ce
+	ocf_log info "Pausing to give evacuations from ${NOVA_HOST} time to complete"
b4b3ce
+	sleep ${OCF_RESKEY_evacuation_delay}
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    touch "$statefile"
b4b3ce
+
b4b3ce
+    return $OCF_SUCCESS
b4b3ce
+}
b4b3ce
+
b4b3ce
+nova_stop() {
b4b3ce
+    rm -f "$statefile"
b4b3ce
+    return $OCF_SUCCESS
b4b3ce
+}
b4b3ce
+
b4b3ce
+nova_monitor() {
b4b3ce
+    if [ ! -f "$statefile" ]; then
b4b3ce
+        return $OCF_NOT_RUNNING
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    return $OCF_SUCCESS
b4b3ce
+}
b4b3ce
+
b4b3ce
+nova_notify() {
b4b3ce
+    return $OCF_SUCCESS
b4b3ce
+}
b4b3ce
+
b4b3ce
+build_unfence_overlay() {
b4b3ce
+    fence_options=""
b4b3ce
+
b4b3ce
+    if [ -z "${OCF_RESKEY_auth_url}" ]; then
b4b3ce
+	candidates=$(/usr/sbin/stonith_admin -l ${NOVA_HOST})
b4b3ce
+	for candidate in ${candidates}; do
b4b3ce
+	    pcs stonith show $d | grep -q fence_compute
b4b3ce
+	    if [ $? = 0 ]; then
b4b3ce
+		ocf_log info "Unfencing nova based on: $candidate"
b4b3ce
+		fence_auth=$(pcs stonith show $candidate | grep Attributes: | sed -e s/Attributes:// -e s/-/_/g -e 's/[^ ]\+=/OCF_RESKEY_\0/g' -e s/passwd/password/g)
b4b3ce
+		eval "export $fence_auth"
b4b3ce
+		break
b4b3ce
+	    fi
b4b3ce
+	done
b4b3ce
+    fi    
b4b3ce
+
b4b3ce
+    # Copied from NovaEvacuate 
b4b3ce
+    if [ -z "${OCF_RESKEY_auth_url}" ]; then
b4b3ce
+        ocf_exit_reason "auth_url not configured"
b4b3ce
+        exit $OCF_ERR_CONFIGURED
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    fence_options="${fence_options} -k ${OCF_RESKEY_auth_url}"
b4b3ce
+
b4b3ce
+    if [ -z "${OCF_RESKEY_username}" ]; then
b4b3ce
+        ocf_exit_reason "username not configured"
b4b3ce
+        exit $OCF_ERR_CONFIGURED
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    fence_options="${fence_options} -l ${OCF_RESKEY_username}"
b4b3ce
+
b4b3ce
+    if [ -z "${OCF_RESKEY_password}" ]; then
b4b3ce
+        ocf_exit_reason "password not configured"
b4b3ce
+        exit $OCF_ERR_CONFIGURED
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    fence_options="${fence_options} -p ${OCF_RESKEY_password}"
b4b3ce
+
b4b3ce
+    if [ -z "${OCF_RESKEY_tenant_name}" ]; then
b4b3ce
+        ocf_exit_reason "tenant_name not configured"
b4b3ce
+        exit $OCF_ERR_CONFIGURED
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    fence_options="${fence_options} -t ${OCF_RESKEY_tenant_name}"
b4b3ce
+
b4b3ce
+    if [ -n "${OCF_RESKEY_domain}" ]; then
b4b3ce
+        fence_options="${fence_options} -d ${OCF_RESKEY_domain}"
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    if [ -n "${OCF_RESKEY_region_name}" ]; then
b4b3ce
+        fence_options="${fence_options} \
b4b3ce
+            --region-name ${OCF_RESKEY_region_name}"
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    if [ -n "${OCF_RESKEY_insecure}" ]; then
b4b3ce
+        if ocf_is_true "${OCF_RESKEY_insecure}"; then
b4b3ce
+            fence_options="${fence_options} --insecure"
b4b3ce
+        fi
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    if [ -n "${OCF_RESKEY_no_shared_storage}" ]; then
b4b3ce
+        if ocf_is_true "${OCF_RESKEY_no_shared_storage}"; then
b4b3ce
+            fence_options="${fence_options} --no-shared-storage"
b4b3ce
+        fi
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    if [ -n "${OCF_RESKEY_endpoint_type}" ]; then
b4b3ce
+        case ${OCF_RESKEY_endpoint_type} in
b4b3ce
+            adminURL|publicURL|internalURL)
b4b3ce
+                ;;
b4b3ce
+            *)
b4b3ce
+                ocf_exit_reason "endpoint_type ${OCF_RESKEY_endpoint_type}" \
b4b3ce
+                    "not valid. Use adminURL or publicURL or internalURL"
b4b3ce
+                exit $OCF_ERR_CONFIGURED
b4b3ce
+                ;;
b4b3ce
+        esac
b4b3ce
+        fence_options="${fence_options} -e ${OCF_RESKEY_endpoint_type}"
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    mkdir -p /run/systemd/system/openstack-nova-compute.service.d
b4b3ce
+    cat<<EOF>/run/systemd/system/openstack-nova-compute.service.d/unfence-20.conf
b4b3ce
+[Service]
b4b3ce
+ExecStartPost=/sbin/fence_compute ${fence_options} -o on -n ${NOVA_HOST}
b4b3ce
+EOF
b4b3ce
+}
b4b3ce
+
b4b3ce
+nova_validate() {
b4b3ce
+    rc=$OCF_SUCCESS
b4b3ce
+
b4b3ce
+    check_binary crudini
b4b3ce
+    check_binary nova-compute
b4b3ce
+    check_binary fence_compute
b4b3ce
+
b4b3ce
+    if [ ! -f /etc/nova/nova.conf ]; then
b4b3ce
+	   ocf_exit_reason "/etc/nova/nova.conf not found"
b4b3ce
+	   exit $OCF_ERR_CONFIGURED
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    # Is the state directory writable?
b4b3ce
+    state_dir=$(dirname $statefile)
b4b3ce
+    touch "$state_dir/$$"
b4b3ce
+    if [ $? != 0 ]; then
b4b3ce
+        ocf_exit_reason "Invalid state directory: $state_dir"
b4b3ce
+        return $OCF_ERR_ARGS
b4b3ce
+    fi
b4b3ce
+    rm -f "$state_dir/$$"
b4b3ce
+
b4b3ce
+    NOVA_HOST=$(crudini --get /etc/nova/nova.conf DEFAULT host 2>/dev/null)
b4b3ce
+    if [ $? = 1 ]; then
b4b3ce
+        short_host=$(uname -n | awk -F. '{print $1}')
b4b3ce
+        if [ "x${OCF_RESKEY_domain}" != x ]; then
b4b3ce
+            NOVA_HOST=${short_host}.${OCF_RESKEY_domain}
b4b3ce
+        else
b4b3ce
+            NOVA_HOST=$(uname -n)
b4b3ce
+        fi
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    if [ $rc != $OCF_SUCCESS ]; then
b4b3ce
+	exit $rc
b4b3ce
+    fi
b4b3ce
+    return $rc
b4b3ce
+}
b4b3ce
+
b4b3ce
+statefile="${HA_RSCTMP}/${OCF_RESOURCE_INSTANCE}.active"
b4b3ce
+
b4b3ce
+: ${OCF_RESKEY_evacuation_delay=120}
b4b3ce
+case $__OCF_ACTION in
b4b3ce
+meta-data)	meta_data
b4b3ce
+		exit $OCF_SUCCESS
b4b3ce
+		;;
b4b3ce
+usage|help)	nova_usage
b4b3ce
+		exit $OCF_SUCCESS
b4b3ce
+		;;
b4b3ce
+esac
b4b3ce
+
b4b3ce
+case $__OCF_ACTION in
b4b3ce
+start)		nova_validate; nova_start;;
b4b3ce
+stop)		nova_stop;;
b4b3ce
+monitor)	nova_validate; nova_monitor;;
b4b3ce
+notify)		nova_notify;;
b4b3ce
+validate-all)	exit $OCF_SUCCESS;;
b4b3ce
+*)		nova_usage
b4b3ce
+		exit $OCF_ERR_UNIMPLEMENTED
b4b3ce
+		;;
b4b3ce
+esac
b4b3ce
+rc=$?
b4b3ce
+ocf_log debug "${OCF_RESOURCE_INSTANCE} $__OCF_ACTION : $rc"
b4b3ce
+exit $rc
b4b3ce
+
a142ce
diff --color -uNr a/heartbeat/NovaEvacuate b/heartbeat/NovaEvacuate
b4b3ce
--- a/heartbeat/NovaEvacuate	1970-01-01 01:00:00.000000000 +0100
a142ce
+++ b/heartbeat/NovaEvacuate	2021-08-24 17:59:40.682372770 +0200
a142ce
@@ -0,0 +1,407 @@
a142ce
+#!/bin/bash
b4b3ce
+#
b4b3ce
+# Copyright 2015 Red Hat, Inc.
b4b3ce
+#
b4b3ce
+# Description:  Manages evacuation of nodes running nova-compute
b4b3ce
+#
b4b3ce
+# Authors: Andrew Beekhof
b4b3ce
+#
b4b3ce
+# Support:      openstack@lists.openstack.org
b4b3ce
+# License:      Apache Software License (ASL) 2.0
b4b3ce
+#
b4b3ce
+
b4b3ce
+
b4b3ce
+#######################################################################
b4b3ce
+# Initialization:
b4b3ce
+
b4b3ce
+###
b4b3ce
+: ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}
b4b3ce
+. ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs
b4b3ce
+###
b4b3ce
+
b4b3ce
+: ${__OCF_ACTION=$1}
b4b3ce
+
b4b3ce
+#######################################################################
b4b3ce
+
b4b3ce
+meta_data() {
b4b3ce
+	cat <
b4b3ce
+
b4b3ce
+
b4b3ce
+<resource-agent name="NovaEvacuate" version="1.0">
b4b3ce
+<version>1.0</version>
b4b3ce
+
b4b3ce
+<longdesc lang="en">
b4b3ce
+Facility for tacking a list of compute nodes and reliably evacuating the ones that fence_evacuate has flagged.
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">Evacuator for OpenStack Nova Compute Server</shortdesc>
b4b3ce
+
b4b3ce
+<parameters>
b4b3ce
+
b4b3ce
+<parameter name="auth_url" unique="0" required="1">
b4b3ce
+<longdesc lang="en">
b4b3ce
+Authorization URL for connecting to keystone in admin context
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">Authorization URL</shortdesc>
b4b3ce
+<content type="string" default="" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="username" unique="0" required="1">
b4b3ce
+<longdesc lang="en">
b4b3ce
+Username for connecting to keystone in admin context
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">Username</shortdesc>
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="password" unique="0" required="1">
b4b3ce
+<longdesc lang="en">
b4b3ce
+Password for connecting to keystone in admin context
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">Password</shortdesc>
b4b3ce
+<content type="string" default="" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="tenant_name" unique="0" required="1">
b4b3ce
+<longdesc lang="en">
b4b3ce
+Tenant name for connecting to keystone in admin context.
b4b3ce
+Note that with Keystone V3 tenant names are only unique within a domain.
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">Keystone v2 Tenant or v3 Project Name</shortdesc>
b4b3ce
+<content type="string" default="" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="user_domain" unique="0" required="1">
b4b3ce
+<longdesc lang="en">
b4b3ce
+User's domain name. Used when authenticating to Keystone.
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">Keystone v3 User Domain</shortdesc>
b4b3ce
+<content type="string" default="" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="project_domain" unique="0" required="1">
b4b3ce
+<longdesc lang="en">
b4b3ce
+Domain name containing project. Used when authenticating to Keystone.
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">Keystone v3 Project Domain</shortdesc>
b4b3ce
+<content type="string" default="" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="endpoint_type" unique="0" required="0">
b4b3ce
+<longdesc lang="en">
b4b3ce
+Nova API location (internal, public or admin URL)
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">Nova API location (internal, public or admin URL)</shortdesc>
b4b3ce
+<content type="string" default="" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="region_name" unique="0" required="0">
b4b3ce
+<longdesc lang="en">
b4b3ce
+Region name for connecting to nova.
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">Region name</shortdesc>
b4b3ce
+<content type="string" default="" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="insecure" unique="0" required="0">
b4b3ce
+<longdesc lang="en">
b4b3ce
+Explicitly allow client to perform "insecure" TLS (https) requests.
b4b3ce
+The server's certificate will not be verified against any certificate authorities.
b4b3ce
+This option should be used with caution.
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">Allow insecure TLS requests</shortdesc>
b4b3ce
+<content type="boolean" default="0" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="no_shared_storage" unique="0" required="0">
b4b3ce
+<longdesc lang="en">
b4b3ce
+Disable shared storage recovery for instances. Use at your own risk!
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">Disable shared storage recovery for instances</shortdesc>
b4b3ce
+<content type="boolean" default="0" />
b4b3ce
+</parameter>
b4b3ce
+
b4b3ce
+<parameter name="verbose" unique="0" required="0">
b4b3ce
+<longdesc lang="en">
b4b3ce
+Enable extra logging from the evacuation process
b4b3ce
+</longdesc>
b4b3ce
+<shortdesc lang="en">Enable debug logging</shortdesc>
b4b3ce
+<content type="boolean" default="0" />
b4b3ce
+</parameter>
b4b3ce
+
a142ce
+<parameter name="evacuate_delay" unique="0" required="0">
a142ce
+<longdesc lang="en">
a142ce
+Allows delaying the nova evacuate API call, e.g. to give a storage array time to clean
a142ce
+up eventual locks/leases.
a142ce
+</longdesc>
a142ce
+<shortdesc lang="en">Nova evacuate delay</shortdesc>
a142ce
+<content type="integer" default="0" />
a142ce
+</parameter>
a142ce
+
b4b3ce
+</parameters>
b4b3ce
+
b4b3ce
+<actions>
b4b3ce
+<action name="start"        timeout="20" />
b4b3ce
+<action name="stop"         timeout="20" />
b4b3ce
+<action name="monitor"      timeout="600" interval="10" depth="0"/>
b4b3ce
+<action name="validate-all" timeout="20" />
b4b3ce
+<action name="meta-data"    timeout="5" />
b4b3ce
+</actions>
b4b3ce
+</resource-agent>
b4b3ce
+END
b4b3ce
+}
b4b3ce
+
b4b3ce
+#######################################################################
b4b3ce
+
b4b3ce
+# don't exit on TERM, to test that lrmd makes sure that we do exit
b4b3ce
+trap sigterm_handler TERM
b4b3ce
+sigterm_handler() {
b4b3ce
+	ocf_log info "They use TERM to bring us down. No such luck."
b4b3ce
+	return
b4b3ce
+}
b4b3ce
+
b4b3ce
+evacuate_usage() {
b4b3ce
+	cat <
b4b3ce
+usage: $0 {start|stop|monitor|validate-all|meta-data}
b4b3ce
+
b4b3ce
+Expects to have a fully populated OCF RA-compliant environment set.
b4b3ce
+END
b4b3ce
+}
b4b3ce
+
b4b3ce
+evacuate_stop() {
b4b3ce
+    rm -f "$statefile"
b4b3ce
+    return $OCF_SUCCESS
b4b3ce
+}
b4b3ce
+
b4b3ce
+evacuate_start() {
b4b3ce
+    touch "$statefile"
b4b3ce
+    # Do not invole monitor here so that the start timeout can be low
b4b3ce
+    return $?
b4b3ce
+}
b4b3ce
+
b4b3ce
+update_evacuation() {
b4b3ce
+    attrd_updater -p -n evacuate -Q -N ${1} -v ${2}
b4b3ce
+    arc=$?
b4b3ce
+    if [ ${arc} != 0 ]; then
b4b3ce
+	ocf_log warn "Can not set evacuation state of ${1} to ${2}: ${arc}"
b4b3ce
+    fi
b4b3ce
+    return ${arc}
b4b3ce
+}
b4b3ce
+
b4b3ce
+handle_evacuations() {
b4b3ce
+    while [ $# -gt 0 ]; do
b4b3ce
+	node=$1 
b4b3ce
+	state=$2
b4b3ce
+	shift; shift;
b4b3ce
+	need_evacuate=0
b4b3ce
+
b4b3ce
+	case $state in
b4b3ce
+	    "")
b4b3ce
+	        ;;
b4b3ce
+	    no)
b4b3ce
+		ocf_log debug "$node is either fine or already handled"
b4b3ce
+		;;
b4b3ce
+	    yes) need_evacuate=1
b4b3ce
+		;; 
b4b3ce
+	    *@*)
b4b3ce
+		where=$(echo $state | awk -F@ '{print $1}')
b4b3ce
+		when=$(echo $state | awk -F@ '{print $2}')
b4b3ce
+		now=$(date +%s)
b4b3ce
+
b4b3ce
+		if [ $(($now - $when)) -gt 60 ]; then
b4b3ce
+		    ocf_log info "Processing partial evacuation of $node by $where at $when"
b4b3ce
+		    need_evacuate=1
b4b3ce
+		else
b4b3ce
+		    # Give some time for any in-flight evacuations to either complete or fail
b4b3ce
+		    # Nova won't react well if there are two overlapping requests 
b4b3ce
+		    ocf_log info "Deferring processing partial evacuation of $node by $where at $when"
b4b3ce
+		fi
b4b3ce
+		;;
b4b3ce
+	esac
b4b3ce
+
b4b3ce
+	if [ $need_evacuate = 1 ]; then
b4b3ce
+	    fence_agent="fence_compute"
b4b3ce
+
b4b3ce
+	    if have_binary fence_evacuate
b4b3ce
+	    then
b4b3ce
+		fence_agent="fence_evacuate"
b4b3ce
+	    fi
b4b3ce
+
a142ce
+            if [ ${OCF_RESKEY_evacuate_delay} != 0 ]; then
a142ce
+                ocf_log info "Delaying nova evacuate by $OCF_RESKEY_evacuate_delay seconds"
a142ce
+                sleep ${OCF_RESKEY_evacuate_delay}
a142ce
+            fi
a142ce
+
b4b3ce
+	    ocf_log notice "Initiating evacuation of $node with $fence_agent"
b4b3ce
+	    $fence_agent ${fence_options} -o status -n ${node}
b4b3ce
+	    if [ $? = 1 ]; then
b4b3ce
+		ocf_log info "Nova does not know about ${node}"
b4b3ce
+		# Dont mark as no because perhaps nova is unavailable right now
b4b3ce
+		continue
b4b3ce
+	    fi
b4b3ce
+
b4b3ce
+	    update_evacuation ${node} "$(uname -n)@$(date +%s)"
b4b3ce
+	    if [ $? != 0 ]; then
b4b3ce
+		return $OCF_SUCCESS
b4b3ce
+	    fi
b4b3ce
+
b4b3ce
+	    $fence_agent ${fence_options} -o off -n $node
b4b3ce
+	    rc=$?
b4b3ce
+
b4b3ce
+	    if [ $rc = 0 ]; then
b4b3ce
+		update_evacuation ${node} no
b4b3ce
+		ocf_log notice "Completed evacuation of $node"
b4b3ce
+	    else
b4b3ce
+		ocf_log warn "Evacuation of $node failed: $rc"
b4b3ce
+		update_evacuation ${node} yes
b4b3ce
+	    fi
b4b3ce
+	fi
b4b3ce
+    done
b4b3ce
+
b4b3ce
+    return $OCF_SUCCESS
b4b3ce
+}
b4b3ce
+
b4b3ce
+evacuate_monitor() {
b4b3ce
+    if [ ! -f "$statefile" ]; then
b4b3ce
+	return $OCF_NOT_RUNNING
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    handle_evacuations $(
a142ce
+        attrd_updater -n evacuate -A \
a142ce
+            2> >(grep -v "attribute does not exist" 1>&2) |
b4b3ce
+            sed 's/ value=""/ value="no"/' |
b4b3ce
+            tr '="' '  ' |
b4b3ce
+            awk '{print $4" "$6}'
b4b3ce
+    )
b4b3ce
+    return $OCF_SUCCESS
b4b3ce
+}
b4b3ce
+
b4b3ce
+evacuate_validate() {
b4b3ce
+    rc=$OCF_SUCCESS
b4b3ce
+    fence_options=""
b4b3ce
+
b4b3ce
+    
b4b3ce
+    if ! have_binary fence_evacuate; then
b4b3ce
+       check_binary fence_compute
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    # Is the state directory writable? 
b4b3ce
+    state_dir=$(dirname $statefile)
b4b3ce
+    touch "$state_dir/$$"
b4b3ce
+    if [ $? != 0 ]; then
b4b3ce
+	ocf_exit_reason "Invalid state directory: $state_dir"
b4b3ce
+	return $OCF_ERR_ARGS
b4b3ce
+    fi
b4b3ce
+    rm -f "$state_dir/$$"
b4b3ce
+
b4b3ce
+    if [ -z "${OCF_RESKEY_auth_url}" ]; then
b4b3ce
+	   ocf_exit_reason "auth_url not configured"
b4b3ce
+	   exit $OCF_ERR_CONFIGURED
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    fence_options="${fence_options} -k ${OCF_RESKEY_auth_url}"
b4b3ce
+
b4b3ce
+    if [ -z "${OCF_RESKEY_username}" ]; then
b4b3ce
+	   ocf_exit_reason "username not configured"
b4b3ce
+	   exit $OCF_ERR_CONFIGURED
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    fence_options="${fence_options} -l ${OCF_RESKEY_username}"
b4b3ce
+
b4b3ce
+    if [ -z "${OCF_RESKEY_password}" ]; then
b4b3ce
+	   ocf_exit_reason "password not configured"
b4b3ce
+	   exit $OCF_ERR_CONFIGURED
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    fence_options="${fence_options} -p ${OCF_RESKEY_password}"
b4b3ce
+
b4b3ce
+    if [ -z "${OCF_RESKEY_tenant_name}" ]; then
b4b3ce
+	   ocf_exit_reason "tenant_name not configured"
b4b3ce
+	   exit $OCF_ERR_CONFIGURED
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    fence_options="${fence_options} -t ${OCF_RESKEY_tenant_name}"
b4b3ce
+
b4b3ce
+    if [ -n "${OCF_RESKEY_user_domain}" ]; then
b4b3ce
+        fence_options="${fence_options} -u ${OCF_RESKEY_user_domain}"
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    if [ -n "${OCF_RESKEY_project_domain}" ]; then
b4b3ce
+        fence_options="${fence_options} -P ${OCF_RESKEY_project_domain}"
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    if [ -n "${OCF_RESKEY_region_name}" ]; then
b4b3ce
+        fence_options="${fence_options} \
b4b3ce
+            --region-name ${OCF_RESKEY_region_name}"
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    if [ -n "${OCF_RESKEY_insecure}" ]; then
b4b3ce
+        if ocf_is_true "${OCF_RESKEY_insecure}"; then
b4b3ce
+            fence_options="${fence_options} --insecure"
b4b3ce
+        fi
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    if [ -n "${OCF_RESKEY_no_shared_storage}" ]; then
b4b3ce
+	if ocf_is_true "${OCF_RESKEY_no_shared_storage}"; then
b4b3ce
+	    fence_options="${fence_options} --no-shared-storage"
b4b3ce
+	fi
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    if [ -n "${OCF_RESKEY_verbose}" ]; then
b4b3ce
+        if ocf_is_true "${OCF_RESKEY_verbose}"; then
b4b3ce
+            fence_options="${fence_options} --verbose"
b4b3ce
+        fi
b4b3ce
+    fi
b4b3ce
+
b4b3ce
+    if [ -n "${OCF_RESKEY_endpoint_type}" ]; then
b4b3ce
+	case ${OCF_RESKEY_endpoint_type} in
b4b3ce
+	    adminURL|publicURL|internalURL) ;;
b4b3ce
+	    *)
b4b3ce
+		ocf_exit_reason "endpoint_type ${OCF_RESKEY_endpoint_type} not valid. Use adminURL or publicURL or internalURL"
b4b3ce
+		exit $OCF_ERR_CONFIGURED
b4b3ce
+	    ;;
b4b3ce
+	esac
b4b3ce
+	fence_options="${fence_options} -e ${OCF_RESKEY_endpoint_type}"
b4b3ce
+    fi
b4b3ce
+
a142ce
+    if [ -z "${OCF_RESKEY_evacuate_delay}" ]; then
a142ce
+        OCF_RESKEY_evacuate_delay=0
a142ce
+    fi
a142ce
+
b4b3ce
+    if [ $rc != $OCF_SUCCESS ]; then
b4b3ce
+	exit $rc
b4b3ce
+    fi
b4b3ce
+    return $rc
b4b3ce
+}
b4b3ce
+
b4b3ce
+statefile="${HA_RSCTMP}/${OCF_RESOURCE_INSTANCE}.active"
b4b3ce
+
b4b3ce
+case $__OCF_ACTION in
b4b3ce
+    start)
b4b3ce
+	evacuate_validate
b4b3ce
+	evacuate_start
b4b3ce
+	;;
b4b3ce
+    stop)
b4b3ce
+	evacuate_stop
b4b3ce
+	;;
b4b3ce
+    monitor)
b4b3ce
+	evacuate_validate
b4b3ce
+	evacuate_monitor
b4b3ce
+	;;
b4b3ce
+    meta-data)
b4b3ce
+	meta_data
b4b3ce
+	exit $OCF_SUCCESS
b4b3ce
+	;;
b4b3ce
+    usage|help)
b4b3ce
+	evacuate_usage
b4b3ce
+	exit $OCF_SUCCESS
b4b3ce
+	;;
b4b3ce
+    validate-all)
b4b3ce
+	exit $OCF_SUCCESS
b4b3ce
+	;;
b4b3ce
+    *)
b4b3ce
+	evacuate_usage
b4b3ce
+	exit $OCF_ERR_UNIMPLEMENTED
b4b3ce
+	;;
b4b3ce
+esac
b4b3ce
+rc=$?
b4b3ce
+ocf_log debug "${OCF_RESOURCE_INSTANCE} $__OCF_ACTION : $rc"
b4b3ce
+exit $rc