Merge lp:~cbjchen/charms/trusty/nova-compute/remove_stale_key into lp:~openstack-charmers-archive/charms/trusty/nova-compute/next

[Liang Chen]

Clean up the keyring for glance after ceph service is destroyed and re-created like below,

1. break relation
2. destroy service
3. deploy new ceph service
4. add relation back

If old key exists, ensure_ceph_keyring will not store the newly retrieved key from ceph. There is another thing to be aware of for nova-compute node - stale libvirt secret key which will also be replaced with this patch. Though existing instances will not work anymore. There is nothing we can do in case the backend storage service(ceph) is destroyed. But this patch will at least make sure the nova-compute service continue to work.

[uosci-testing-bot (uosci-testing-bot)]

charm_lint_check #1783 nova-compute-next for cbjchen mp248949
    LINT FAIL: lint-test failed

LINT Results (max last 2 lines):
  hooks/nova_compute_utils.py:27:9: W291 trailing whitespace
  make: *** [lint] Error 1

Full lint test output: http://paste.ubuntu.com/10110137/
Build: http://10.245.162.77:8080/job/charm_lint_check/1783/

[uosci-testing-bot (uosci-testing-bot)]

charm_unit_test #1611 nova-compute-next for cbjchen mp248949
    UNIT FAIL: unit-test failed

UNIT Results (max last 2 lines):
  FAILED (SKIP=5, failures=1)
  make: *** [unit_test] Error 1

Full unit test output: http://paste.ubuntu.com/10110139/
Build: http://10.245.162.77:8080/job/charm_unit_test/1611/

[uosci-testing-bot (uosci-testing-bot)]

charm_amulet_test #1803 nova-compute-next for cbjchen mp248949
    AMULET OK: passed

Build: http://10.245.162.77:8080/job/charm_amulet_test/1803/

[Edward Hope-Morley (hopem)]

I've deployed this along with the other ceph client changes and it all seems good. There is lint error but i'll fix when merging. Thanks Liang. +1

review: Approve

=== modified file '.pydevproject'
--- .pydevproject	2013-11-17 21:48:39 +0000
+++ .pydevproject	2015-02-06 18:21:32 +0000
@@ -3,7 +3,7 @@
 <pydev_property name="org.python.pydev.PYTHON_PROJECT_VERSION">python 2.7</pydev_property>
 <pydev_property name="org.python.pydev.PYTHON_PROJECT_INTERPRETER">Default</pydev_property>
 <pydev_pathproperty name="org.python.pydev.PROJECT_SOURCE_PATH">
-<path>/nova-compute/hooks</path>
-<path>/nova-compute/unit_tests</path>
+<path>/nova-compute-charm/hooks</path>
+<path>/nova-compute-charm/unit_tests</path>
 </pydev_pathproperty>
 </pydev_project>

=== added file 'README.md'
--- README.md	1970-01-01 00:00:00 +0000
+++ README.md	2015-02-06 18:21:32 +0000
@@ -0,0 +1,7 @@
+=====================
+nova-compute
+=====================
+
+Compute node for Openstack nova.
+
+

=== modified file 'config.yaml'
--- config.yaml	2014-12-15 11:38:06 +0000
+++ config.yaml	2015-02-06 18:21:32 +0000
@@ -124,7 +124,7 @@
       this allows you to differentiate between them.
   disable-neutron-security-groups:
     type: boolean
-    default:
+    default: False
     description: |
       Disable neutron based security groups - setting this configuration option
       will override any settings configured via the nova-cloud-controller charm.

=== modified file 'hooks/nova_compute_hooks.py'
--- hooks/nova_compute_hooks.py	2015-01-12 12:04:00 +0000
+++ hooks/nova_compute_hooks.py	2015-02-06 18:21:32 +0000
@@ -34,6 +34,7 @@
     ensure_ceph_keyring,
     CephBrokerRq,
     CephBrokerRsp,
+    delete_keyring,
 )
 from charmhelpers.payload.execd import execd_preinstall
 from nova_compute_utils import (
@@ -282,8 +283,14 @@
                 log("Request(s) sent to Ceph broker (rid=%s)" % (rid))
 
 
[e-mail]('ceph-relation-broken')
+def ceph_broken():
+    service = service_name()
+    delete_keyring(service=service)
+    CONFIGS.write_all()
+
+
 @hooks.hook('amqp-relation-broken',
-            'ceph-relation-broken',
             'image-service-relation-broken',
             'shared-db-relation-broken',
             'pgsql-db-relation-broken')

=== modified file 'hooks/nova_compute_utils.py'
--- hooks/nova_compute_utils.py	2014-12-16 17:28:40 +0000
+++ hooks/nova_compute_utils.py	2015-02-06 18:21:32 +0000
@@ -23,7 +23,8 @@
     related_units,
     relation_ids,
     relation_get,
-    DEBUG
+    DEBUG,
+    INFO 
 )
 
 from charmhelpers.contrib.openstack.neutron import neutron_plugin_attribute
@@ -448,9 +449,15 @@
 def create_libvirt_secret(secret_file, secret_uuid, key):
     uri = LIBVIRT_URIS[config('virt-type')]
     if secret_uuid in check_output(['virsh', '-c', uri, 'secret-list']):
-        log('Libvirt secret already exists for uuid %s.' % secret_uuid,
-            level=DEBUG)
-        return
+        old_key = check_output(['virsh', '-c', uri, 'secret-get-value',
+                                secret_uuid])
+        if old_key == key:
+            log('Libvirt secret already exists for uuid %s.' % secret_uuid,
+                level=DEBUG)
+            return
+        else:
+            log('Libvirt secret changed for uuid %s.' % secret_uuid,
+                level=INFO)
     log('Defining new libvirt secret for uuid %s.' % secret_uuid)
     cmd = ['virsh', '-c', uri, 'secret-define', '--file', secret_file]
     check_call(cmd)

=== modified file 'tests/basic_deployment.py'
--- tests/basic_deployment.py	2014-09-30 20:31:36 +0000
+++ tests/basic_deployment.py	2015-02-06 18:21:32 +0000
@@ -20,7 +20,7 @@
 class NovaBasicDeployment(OpenStackAmuletDeployment):
     """Amulet tests on a basic nova compute deployment."""
 
-    def __init__(self, series=None, openstack=None, source=None, stable=False):
+    def __init__(self, series=None, openstack=None, source=None, stable=True):
         """Deploy the entire test environment."""
         super(NovaBasicDeployment, self).__init__(series, openstack, source, stable)
         self._add_services()

=== modified file 'unit_tests/test_nova_compute_utils.py'
--- unit_tests/test_nova_compute_utils.py	2014-12-15 10:28:47 +0000
+++ unit_tests/test_nova_compute_utils.py	2015-02-06 18:21:32 +0000
@@ -1,6 +1,7 @@
 import itertools
 import tempfile
 
+import nova_compute_context as compute_context
 import nova_compute_utils as utils
 
 from mock import (
@@ -322,3 +323,55 @@
         utils.disable_shell('dummy')
         _check_call.assert_called_with(['usermod', '-s', '/bin/false',
                                         'dummy'])
+
+    @patch.object(utils, 'check_call')
+    @patch.object(utils, 'check_output')
+    def test_create_libvirt_key(self, _check_output, _check_call):
+        key = 'AQCR2dRUaFQSOxAAC5fr79sLL3d7wVvpbbRFMg=='
+        self.test_config.set('virt-type', 'kvm')
+        utils.create_libvirt_secret(utils.CEPH_SECRET,
+                                    compute_context.CEPH_SECRET_UUID, key)
+        _check_output.assert_called_with(['virsh', '-c',
+                                          utils.LIBVIRT_URIS['kvm'],
+                                          'secret-list'])
+        _check_call.assert_called_with(['virsh', '-c',
+                                        utils.LIBVIRT_URIS['kvm'],
+                                        'secret-set-value', '--secret',
+                                        compute_context.CEPH_SECRET_UUID,
+                                        '--base64', key])
+
+    @patch.object(utils, 'check_call')
+    @patch.object(utils, 'check_output')
+    def test_create_libvirt_key_existing(self, _check_output, _check_call):
+        key = 'AQCR2dRUaFQSOxAAC5fr79sLL3d7wVvpbbRFMg=='
+        self.test_config.set('virt-type', 'kvm')
+        _check_output.side_effect = [compute_context.CEPH_SECRET_UUID, key]
+        utils.create_libvirt_secret(utils.CEPH_SECRET,
+                                    compute_context.CEPH_SECRET_UUID, key)
+        expected = [call(['virsh', '-c',
+                          utils.LIBVIRT_URIS['kvm'], 'secret-list']),
+                    call(['virsh', '-c',
+                          utils.LIBVIRT_URIS['kvm'], 'secret-get-value',
+                          compute_context.CEPH_SECRET_UUID])]
+        _check_output.assert_has_calls(expected)
+
+    @patch.object(utils, 'check_call')
+    @patch.object(utils, 'check_output')
+    def test_create_libvirt_key_stale(self, _check_output, _check_call):
+        key = 'AQCR2dRUaFQSOxAAC5fr79sLL3d7wVvpbbRFMg=='
+        old_key = 'CCCCCdRUaFQSOxAAC5fr79sLL3d7wVvpbbRFMg=='
+        self.test_config.set('virt-type', 'kvm')
+        _check_output.side_effect = [compute_context.CEPH_SECRET_UUID, old_key]
+        utils.create_libvirt_secret(utils.CEPH_SECRET,
+                                    compute_context.CEPH_SECRET_UUID, key)
+        expected = [call(['virsh', '-c',
+                          utils.LIBVIRT_URIS['kvm'], 'secret-list']),
+                    call(['virsh', '-c',
+                          utils.LIBVIRT_URIS['kvm'], 'secret-get-value',
+                          compute_context.CEPH_SECRET_UUID])]
+        _check_output.assert_has_calls(expected)
+        _check_call.assert_any_call(['virsh', '-c',
+                                     utils.LIBVIRT_URIS['kvm'],
+                                     'secret-set-value', '--secret',
+                                     compute_context.CEPH_SECRET_UUID,
+                                     '--base64', key])