Merge ~lucaskanashiro/ubuntu/+source/fence-agents:backport_aws_imdsv2_groovy into ubuntu/+source/fence-agents:ubuntu/groovy-devel

[Lucas Kanashiro]

Backport fence_aws with IMDSv2 support to Groovy. This is the upstream commit:

https://github.com/ClusterLabs/fence-agents/commit/c9f8890264e0257197b31124dbb26c1046475314

The SRU bug description is still incomplete because we are going to ask AWS folks on how to test it properly, but this MP is for reviewing the packaging work.

PPA:

https://launchpad.net/~lucaskanashiro/+archive/ubuntu/ha-stack-aws

autopkgtest:

autopkgtest [13:02:30]: @@@@@@@@@@@@@@@@@@@@ summary
metadata PASS
delay PASS
fence-dummy PASS
fence-aws SKIP exit status 77 and marked as skippable

[Christian Ehrhardt  (paelzer)]

here as well 4.6.0-1ubuntu1 -> 4.6.0-1ubuntu0.1

[Christian Ehrhardt  (paelzer)]

review: Needs Fixing

[Christian Ehrhardt  (paelzer)]

Other than the version number everything else LGTM.
The patch matches what is upstream and on this version applied fine.

[Christian Ehrhardt  (paelzer)]

For my thoughts on resource agents, you see here they gracefully catch the "HTTP error occurred while trying to access EC2 metadata server" and log an error but otherwise continue.
So if that being unavailable is a thing, how gracefully (or not) will that be in resource agents?

[Lucas Kanashiro (lucaskanashiro)]

Thanks for the review. Version is already fixed.

I'll be following up the other question with AWS.

[Christian Ehrhardt  (paelzer)]

Hi Lucas,
I know that some of these wait for the MIR, but can we set them either to merged (if uploaded) or to WIP (if waiting) to clear the view of MRs the Team has to do?

[Lucas Kanashiro (lucaskanashiro)]

The proposed changes are waiting for some testing from AWS side (available in the mentioned PPA), so I'll be marking this as WIP until we get a reply.

Unmerged commits

25e24d1... by Lucas Kanashiro on 2021-02-09

update-maintainer

78c06cd... by Lucas Kanashiro on 2021-02-09

Update changelog

c2fd544... by Lucas Kanashiro on 2021-02-09

Backport patch to make fence_aws support IMDSv2 (LP: #1915190)

diff --git a/debian/changelog b/debian/changelog
index 20cd619..dc6c361 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+fence-agents (4.6.0-1ubuntu0.1) groovy; urgency=medium
+
+  * Backport patch to make fence_aws support IMDSv2 (LP: #1915190).
+    - d/p/fence_aws-add-support-for-IMDSv2.patch
+
+ -- Lucas Kanashiro <[e-mail]>  Tue, 09 Feb 2021 16:14:17 -0300
+
 fence-agents (4.6.0-1) unstable; urgency=medium
 
   * New upstream version 4.6.0
diff --git a/debian/control b/debian/control
index 90528e8..6befa96 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: fence-agents
 Section: admin
 Priority: optional
-Maintainer: Debian HA Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian HA Maintainers <[e-mail]>
 Uploaders: Adrian Vondendriesch <[e-mail]>,
            Valentin Vidic <[e-mail]>
 Build-Depends: autoconf,
diff --git a/debian/patches/fence_aws-add-support-for-IMDSv2.patch b/debian/patches/fence_aws-add-support-for-IMDSv2.patch
new file mode 100644
index 0000000..ec9b728
--- /dev/null
+++ b/debian/patches/fence_aws-add-support-for-IMDSv2.patch
@@ -0,0 +1,42 @@
+From: Oyvind Albrigtsen <[e-mail]>
+Date: Fri, 13 Nov 2020 14:30:43 +0100
+Subject: fence_aws: add support for IMDSv2
+
+Origin: upstream, https://github.com/ClusterLabs/fence-agents/commit/c9f8890264e0257197b31
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/fence-agents/+bug/1915190
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+---
+ agents/aws/fence_aws.py | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/agents/aws/fence_aws.py b/agents/aws/fence_aws.py
+index 483a299..e2a2391 100644
+--- a/agents/aws/fence_aws.py
++++ b/agents/aws/fence_aws.py
+@@ -3,12 +3,13 @@
+ import sys, re
+ import logging
+ import atexit
+-import requests
+ sys.path.append("@FENCEAGENTSLIBDIR@")
+ from fencing import *
+ from fencing import fail, fail_usage, run_delay, EC_STATUS, SyslogLibHandler
+ 
++import requests
+ import boto3
++from requests import HTTPError
+ from botocore.exceptions import ConnectionError, ClientError, EndpointConnectionError, NoRegionError
+ 
+ logger = logging.getLogger("fence_aws")
+@@ -19,8 +20,9 @@ logging.getLogger('botocore.vendored').propagate = False
+ 
+ def get_instance_id():
+ 	try:
+-		r = requests.get('http://169.254.169.254/latest/meta-data/instance-id')
+-		return r.content.decode("UTF-8")
++		token = requests.put('http://169.254.169.254/latest/api/token', headers={"X-aws-ec2-metadata-token-ttl-seconds" : "21600"}).content.decode("UTF-8")
++		r = requests.get('http://169.254.169.254/latest/meta-data/instance-id', headers={"X-aws-ec2-metadata-token" : token}).content.decode("UTF-8")
++		return r
+ 	except HTTPError as http_err:
+ 		logger.error('HTTP error occurred while trying to access EC2 metadata server: %s', http_err)
+ 	except Exception as err:
diff --git a/debian/patches/series b/debian/patches/series
index 3ec598e..a21ade7 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,3 @@
 disable-network-access
 spelling
+fence_aws-add-support-for-IMDSv2.patch