Fix types for queries in QA

Due to the actual implementation of the '?' operator
in our query language, it happily accepted essentially
any value that was not 0 or False as being true. However,
it was always only specified to work on boolean values.
Therefore, our QA shouldn't test for this unspecified
behavior to work.

Signed-off-by: Klaus Aehlig <aehlig@google.com>
Reviewed-by: Helga Velroyen <helgav@google.com>
Remove superfluous imports

This removes some superfluous imports from the X509 (SSL)
unittests.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Utility functions to manipulate the candidate map

This patch adds a couple of utility functions to manipulate
the map of master candidate SSL certificate digests.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Retrieve a node's certificate digest

In various cluster operations, the master node needs to
retrieve the digest of a node's SSL certificate. For this
purpose, we add an RPC call to retrieve the digest. The
function is designed in a general way to make it possible
to retrieve other (public) cryptographic tokens of a node
in the future as well (for example an SSH key).

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Add candiate certificate map to configuration

At the end of this patch series, incoming RPC calls are
legitimized against a map of master candidate nodes'
SSL certificate digests. This patch adds the map itself
to the cluster's configuration.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Add certificate for master node

On cluster initialization, the master node's
SSL certificate digest is added to the list of master
candidate certificates.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Handle client certificates on node add/remove

This patch adds the certificate of a newly added or
readded master candidate node to the map of master candidate
certificates. It removes a master candidate node's certificate
digest from the candidate certificate map if the node is
removed from the cluster.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Store candidate certificates in ssconf

This patch enables Ganeti to store the candidate
certificate map in ssconf. A utility function to
read it is provided as well.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Create client SSL certificates on cluster init

This patch makes Ganeti create a client SSL certificate for
the master node on cluster initialization. Note that some of
the code in this patch is later moved into an LU to serve
requirements for crypto renewal and updates, but for this
point in the patch series it makes sense to add it here.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Extend RPC call to create SSL certificates

So far the RPC call 'node_crypto_tokens' did only retrieve
the certificate digest of an existing certificate. This
call is now enhanced to also create a new certificate and
return the respective digest. This will be used in various
operations, among those cluster init and renew-crypto.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Handle promoting/demoting nodes wrt to client certificates

This patch makes Ganeti correctly handle the client
certificates when nodes get promoted to master candidates
or demoted to normal nodes.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Verify incoming RPCs against candidate map

From this patch on, incoming RPC calls are checked against
the map of valid master candidate certificates. If no map
is present, the cluster is assumed to be in
bootstrap/upgrade mode and compares the incoming call
against the server certificate. This is necessary, because
neither at cluster initialization nor at upgrades from
pre-2.11 versions a candidate map is established yet.

After an upgrade, the cluster RPC communication continues
to use the server certificate until the client certificates
are created and the candidate map is populated using
'gnt-cluster renew-crypto --new-node-certificates'.

Note that for updating the master's certificate, a trick
was necessary. The new certificate is first created under
a temporary name, then it's digest is updated and
distributed using the old certificate, because otherwise
distribution will fail since the nodes don't know the
new digest yet. Then the certificate is moved to its
proper location.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Verify client certificates

This patch adds a step to 'gnt-cluster verify' to verify
the existence and validity of the nodes' client
certificates. Since this is a crucial point of the
security concept, the verification is very detailed with
expressive error messages and well tested by unit tests.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Update NEWS wrt to client RPC certificates

This updates the NEWS file regarding the changes in
RPC communication.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Update UPGRADE nodes

Adds to the upgrade nodes that a renewal of the node
certificates is necessary.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Update design doc to match implementation

This patch contains some minor changes in the design doc
to make sure the details match the implementation.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Improve debugging by logging inotify events

At debug level, not only log that an inotify triggered,
but also log the actual event.

Signed-off-by: Klaus Aehlig <aehlig@google.com>
Reviewed-by: Helga Velroyen <helgav@google.com>
Improve debug-logging for watch file

Also log, at debug level only, when a change of a watched
file was observed, but the change did not result in any
change of derived value.

Signed-off-by: Klaus Aehlig <aehlig@google.com>
Reviewed-by: Helga Velroyen <helgav@google.com>
Reinstantiate inotify after a lost file

When watching a file, reinstantiate the inotify if notified
of an event that removes the watch. Such events are likely
to happen, as our usual way to "modify" a file is to atomically
replace it by another one.

Signed-off-by: Klaus Aehlig <aehlig@google.com>
Reviewed-by: Helga Velroyen <helgav@google.com>
Eliminate installation modes in OS reinstalls doc

Eliminate installation modes in OS reinstalls design doc and instead
allow disk images and OS scripts to be combined, with an optional
virtualized environment.

Signed-off-by: Jose A. Lopes <jabolopes@google.com>
Reviewed-by: Michele Tartara <mtartara@google.com>