Merge lp:~james-page/charms/trusty/percona-cluster/1497527 into lp:~openstack-charmers-archive/charms/trusty/percona-cluster/next

[James Page]

This change ensures that for configurations using access-network, access is only granted to IP addresses within the access-network CIDR, avoiding race conditions where the db_host presented to remote units get switch to the local access-network IP address for the PXC unit, allowed_hosts containers all remote unit names, but access has not been granted for all remote units for access-network IP addresses.

The old behaviour would grant access for any presented address, and then upgrade the grants to the new IP address once the remote units changed the 'hostname' relation data.

[lp:~james-page/charms/trusty/percona-cluster/1497527]

76. By James Page on 2015-09-21

Switch to using get_host_ip

77. By James Page on 2015-09-21

Tidy lint

[uosci-testing-bot (uosci-testing-bot)]

charm_lint_check #10403 percona-cluster-next for james-page mp271772
    LINT OK: passed

Build: http://10.245.162.77:8080/job/charm_lint_check/10403/

[uosci-testing-bot (uosci-testing-bot)]

charm_unit_test #9549 percona-cluster-next for james-page mp271772
    UNIT OK: passed

Build: http://10.245.162.77:8080/job/charm_unit_test/9549/

[uosci-testing-bot (uosci-testing-bot)]

charm_amulet_test #6545 percona-cluster-next for james-page mp271772
    AMULET OK: passed

Build: http://10.245.162.77:8080/job/charm_amulet_test/6545/

[Liam Young (gnuoy)]

Tested with one glance node and one percona node.

Juju deployment network: 172.16.0.0/24
OS Access Network: 10.10.0.0/24

http://paste.ubuntu.com/12513262/

LGTM

[Edward Hope-Morley (hopem)]

LGTM +1

=== modified file 'hooks/percona_hooks.py'
--- hooks/percona_hooks.py	2015-09-11 22:42:14 +0000
+++ hooks/percona_hooks.py	2015-09-21 07:57:49 +0000
@@ -429,6 +429,9 @@
     access_network = config('access-network')
     db_helper = get_db_helper()
 
+    peer_store_and_set(relation_id=relation_id,
+                       relation_settings={'access-network': access_network})
+
     singleset = set(['database', 'username', 'hostname'])
     if singleset.issubset(settings):
         # Process a single database configuration
@@ -436,6 +439,15 @@
         database = settings['database']
         username = settings['username']
 
+        normalized_address = get_host_ip(hostname)
+        if access_network and not is_address_in_network(access_network,
+                                                        normalized_address):
+            # NOTE: for configurations using access-network, only setup
+            #       database access if remote unit has presented a
+            #       hostname or ip address thats within the configured
+            #       network cidr
+            return
+
         # NOTE: do this before querying access grants
         password = configure_db_for_hosts(hostname, database, username,
                                           db_helper)
@@ -485,6 +497,16 @@
                 hostname = databases[db]['hostname']
                 username = databases[db]['username']
 
+                normalized_address = get_host_ip(hostname)
+                if (access_network and
+                        not is_address_in_network(access_network,
+                                                  normalized_address)):
+                    # NOTE: for configurations using access-network,
+                    #       only setup database access if remote unit
+                    #       has presented a hostname or ip address
+                    #       thats within the configured network cidr
+                    return
+
                 # NOTE: do this before querying access grants
                 password = configure_db_for_hosts(hostname, database, username,
                                                   db_helper)
@@ -509,9 +531,6 @@
         else:
             log("No return data - not setting relation settings", level=DEBUG)
 
-    peer_store_and_set(relation_id=relation_id,
-                       relation_settings={'access-network': access_network})
-
 
 @hooks.hook('ha-relation-joined')
 def ha_relation_joined():