Node names in NV_VMNODES

This patch populates the list 'NV_VMNODES' with node
names and not node UUIDs, as the backend only uses this
list to identify VM-capable nodes by querying for the
node name.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Renaming NV_VMNODES to NV_NONVMNODES

This patch renames the constant 'NV_VMNODES' to
'NV_NONVMNODES' as it is actually used to store
a list of *non* vm-capable nodes.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Fix invalid message from gnt-os

When we still don't have any os scripts installed, running gnt-os
diagnose or gnt-os info foo(whatever) shows an error message "Can't get
the OS list" even if the request has been succeeded.
The OpOsDiagnose can return a blank list, so we should check whether
the result is None.

Signed-off-by: Yuto KAWAMURA(kawamuray) <kawamuray.dadada@gmail.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>
Fix DRBD version check for non VM capable nodes

Commit 742dc8de revealed a bug concerning DRBD version check during
cluster verify: In case non VM cabables nodes have DRBD not
installed, we get a version mismatch warning.

VerifyNode() updates the NV_DRBDVERSION key in the response message
only if a node is VM capable. Even if noded fails to retrieve the
DRBD version, the error string is returned.

Thus we must first check in _VerifyGroupDRBDVersion() if the
NV_DRBDVERSION key of the response message is updated and
then verify if we have different versions across nodes.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Signed-off-by: Klaus Aehlig <aehlig@google.com>
Reviewed-by: Klaus Aehlig <aehlig@google.com>
Change the default chroot distribution

We are moving away from squeeze on all fronts, and we should do the
same in the build_chroot script.

Signed-off-by: Hrvoje Ribicic <riba@google.com>
Reviewed-by: Helga Velroyen <helgav@google.com>
Make the wheezy chroot use proscribed tools

The wheezy chroot relied on the pylint and pep8 packages supplied by
wheezy, which do not match the ones stated in our developer notes. This
patch fixes this by specifying the versions explicitly.

Signed-off-by: Hrvoje Ribicic <riba@google.com>
Reviewed-by: Helga Velroyen <helgav@google.com>
Removing unused imports from watcher

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Petr Pudlak <pudlak@google.com>
Move InitSSH from bootstrap.py to ssh.py

Since the generation of SSH keys will no longer only
happen at cluster init, but every time a node is added,
we move the "InitSSH" method from bootstrap to the
ssh module to be able to reuse it. No functional
changes otherwise.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Petr Pudlak <pudlak@google.com>
Move Ssh related code to ssh.py

There were a couple of ssh-related utility functions
scattered in io.py. We are moving them to ssh.py to
keep all ssh-related code together.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Petr Pudlak <pudlak@google.com>
Infrastructure to manage public key file

This patch introduced infrastructure to handle the
newly introduced file of public SSH keys of potential
master candidates (as described in
"design-node-security.rst"). It supports the operation
to add and remove keys and to query the file for a set of
keys. In this patch it does not get called by any code yet;
this will be done in the next patches. Unit tests are
included.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Petr Pudlak <pudlak@google.com>
Init pubkey file and transfer authorized keys on node join

This patch initializes the "ganeti_pub_keys" file on
cluster initialization and adds the master's key to it.
On node-add, the key file is queried for the keys of
the master candidates and those are transferred to the
new node and added to its "authorized_keys" file.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Petr Pudlak <pudlak@google.com>
Retrieve public SSH key from new node

On adding a new node, a new public/private SSH key pair
will be generated. The public key pair needs (possibly)
to be added to the 'ganeti_pub_keys' file and the
'authorized_keys' file of other cluster nodes. This patch
provides the mechanism to fetch the new node's public
SSH key via ssh. Node that at this point, no new
public/private key pair is generated yet. This will come
in a later patch of this series as we first want to have
all infrastructure in place.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Petr Pudlak <pudlak@google.com>
ssh.py: clear + overide pubkey + query all

This patch add a couple of new SSH utility functions to
the ssh module:
- clearing the whole 'ganeti_pub_keys' file
- overriding the whole 'ganeti_pub_keys' file
- retrieving all keys from the file at once

Those functions will be used in later patches. Unit tests
are provided.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Petr Pudlak <pudlak@google.com>
Introducing the 'ssh_update' tool

In order to update the 'ganeti_pub_keys' and the
'authorized_keys' files of various nodes via SSH, we
introduce the tool 'ssh_update'. It works similar to the
tool 'prepare_node_join', which is also a tool invoked
via SSH on a remote note.

This patch includes some refactoring to reuse code from
the 'prepare_node_join' tool and provides unit tests as
well. Note that the actual invocation of the 'ssh_update'
tool will be done in later patches of this series.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Petr Pudlak <pudlak@google.com>
Config: retrieve SSH ports and potential master candidates

This patch adds a function to retrieve a map of group UUIDs
to SSH ports to the configuration module. Fixes Issue 773.

Besides that, this patch adds another function to retrieve
the list of potential master candidates.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Petr Pudlak <pudlak@google.com>
Key handling when adding a node

This patch implements the handling of SSH keys, when a new
node is added. It introduces the new RPC call 'ssh_add_key',
which is called to the master's noded when a new node is
added. In the backend implementation, noded takes care of
distributing the new node's SSH key information to all
other nodes in the cluster which are supposed to have
this information.

Note: It was rather tedious to test the backend function,
because it was calling many other functions which would
have needed to be mocked. Instead I added the public key
file as a parameter, because this way I could at least
reduce the complexity of the test setup and at the same
time have direct access to the file that gets manipulated.

Also Note: Up till now, there is still only the common
cluster SSH key around. I wanted to have some
infrastructure in place, before actually individual keys
are generated.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Petr Pudlak <pudlak@google.com>
Key removal in ssh.py and ssh_update.py

This patch prepares the ssh utility library ssh.py and
the ssh update tool with the ability to remove SSH keys
from the 'authorized_keys' and the 'ganeti_pub_keys'
files.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Petr Pudlak <pudlak@google.com>
Handling SSH keys on node removal

This patch implements the handling of SSH keys when a node
is removed from the cluster. It covers the implementation
in the backend, the introduction and calling of a new RPC
call for that purpose.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Petr Pudlak <pudlak@google.com>
Removing old SSH key when readding a node

If a node is readded to the cluster, it might or might
not have an old SSH key distributed on the nodes. In order
to make a clean add, the old key is removed first.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Petr Pudlak <pudlak@google.com>
Generate individual SSH keys

This patch adapts the 'prepare_node_join' tool so
that instead of copying the cluster SSH key to the new
node, an individual SSH key pair is generated for that
node.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Petr Pudlak <pudlak@google.com>