Merge ~racb/ubuntu/+source/fence-agents:azure-sdk-15 into ubuntu/+source/fence-agents:ubuntu/jammy-devel

[Robie Basak]

[Lucas Kanashiro (lucaskanashiro)]

I am going to review this one.

[Lucas Kanashiro (lucaskanashiro)]

I did not test the fence agent itself but I guess Robie did it. Going through the patch, it looks sane to me. I noticed part of this patch is also a backport of this other upstream commit:

https://github.com/ClusterLabs/fence-agents/commit/cb1ff52c14451482dc1faf9aa660a8c525097f94

Maybe it is a good idea to also mention it in the DEP-3 headers for future reference.

Other than that LGTM.

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: racb, lucaskanashiro
Uploaders: racb, lucaskanashiro
MP auto-approved

review: Approve

[Robie Basak (racb)]

> I noticed part of this patch is also a backport of this other upstream commit:

> https://github.com/ClusterLabs/fence-agents/commit/cb1ff52c14451482dc1faf9aa660a8c525097f94

> Maybe it is a good idea to also mention it in the DEP-3 headers for future reference.

Thank you for noticing this! It looks like I neglected to mention this. Actually I think maybe I accidentally got the backport correct because I used a local diff, thinking that there was only one commit that the diff came from when in fact there were two. So I was a bit alarmed and wanted to be sure that I didn't miss anything.

I've checked carefully to confirm that the backport is exactly from these two commits, except for the unused code paths that I removed, and that there are no other commits involved. `git log upstream/main -- agents/azure_arm/fence_azure_arm.py lib/azure_fence.py.py` shows nothing else.

I will add the second commit to the dep3 headers as you suggested.

Thank you for the review!

[Robie Basak (racb)]

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading fence-agents_4.7.1-1ubuntu8.1.dsc: done.
  Uploading fence-agents_4.7.1-1ubuntu8.1.debian.tar.xz: done.
  Uploading fence-agents_4.7.1-1ubuntu8.1_source.changes: done.
Successfully uploaded packages.

[Robie Basak (racb)]

This did land.

diff --git a/debian/changelog b/debian/changelog
index 1fcca07..f515edc 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+fence-agents (4.7.1-1ubuntu8.1) jammy; urgency=medium
+
+  * Update the Azure fencing agent (fence_azure_arm) to support Azure
+    SDK >=15, since this is required by python3-azure in Jammy and this
+    fence agent doesn't work without this update (LP: #1990316).
+
+ -- Robie Basak <[e-mail]>  Wed, 16 Nov 2022 12:11:57 +0000
+
 fence-agents (4.7.1-1ubuntu8) jammy; urgency=medium
 
   * d/curated-agents: add fence_ipmilan and fence_sbd to the -base package.
diff --git a/debian/patches/azure-sdk-15 b/debian/patches/azure-sdk-15
 new file mode 100644
index 0000000..75ed29e
--- /dev/null
+++ b/debian/patches/azure-sdk-15
@@ -0,0 +1,94 @@
+Author: Eike Waldt <[e-mail]>
+Author: Cleber Paiva de Souza <[e-mail]>
+Author: Robie Basak <[e-mail]>
+Origin: backport, https://github.com/ClusterLabs/fence-agents/commit/8d746be92f191aa289f13a3703031c122a5e6cf3
+Origin: backport, https://github.com/ClusterLabs/fence-agents/commit/cb1ff52c14451482dc1faf9aa660a8c525097f94
+Bug-Ubuntu: https://launchpad.net/bugs/1990316
+Description: fence_azure_arm: corrections to support Azure SDK >= 15
+ [Robie Basak]
+ A newer version of python3-azure requires changes in the way the API is used;
+ otherwise the fence agent doesn't work at all. This is a minimal backport of
+ those changes (two commits) to Jammy. I've removed the conditional code that
+ falls back to the old API, as we know that in Jammy the new API is available,
+ and this reduces the number of code paths for which QA may be necessary.
+Last-Update: 2022-11-16
+
+diff --git a/agents/azure_arm/fence_azure_arm.py b/agents/azure_arm/fence_azure_arm.py
+index 6b1a377..daa4cd0 100755
+--- a/agents/azure_arm/fence_azure_arm.py
++++ b/agents/azure_arm/fence_azure_arm.py
+@@ -115,10 +115,10 @@ def set_power_status(clients, options):
+ 
+         if (options["--action"]=="off"):
+             logging.info("Poweroff " + vmName + " in resource group " + rgName)
+-            compute_client.virtual_machines.power_off(rgName, vmName, skip_shutdown=True)
++            compute_client.virtual_machines.begin_power_off(rgName, vmName, skip_shutdown=True)
+         elif (options["--action"]=="on"):
+             logging.info("Starting " + vmName + " in resource group " + rgName)
+-            compute_client.virtual_machines.start(rgName, vmName)
++            compute_client.virtual_machines.begin_start(rgName, vmName)
+ 
+ 
+ def define_new_opts():
+diff --git a/lib/azure_fence.py.py b/lib/azure_fence.py.py
+index 4e44ca9..87b2d3a 100644
+--- a/lib/azure_fence.py.py
++++ b/lib/azure_fence.py.py
+@@ -286,25 +286,25 @@ def get_azure_credentials(config):
+     credentials = None
+     cloud_environment = get_azure_cloud_environment(config)
+     if config.UseMSI and cloud_environment:
+-        from msrestazure.azure_active_directory import MSIAuthentication
+-        credentials = MSIAuthentication(cloud_environment=cloud_environment)
++        from azure.identity import ManagedIdentityCredential
++        credentials = ManagedIdentityCredential(cloud_environment=cloud_environment)
+     elif config.UseMSI:
+-        from msrestazure.azure_active_directory import MSIAuthentication
+-        credentials = MSIAuthentication()
++        from azure.identity import ManagedIdentityCredential
++        credentials = ManagedIdentityCredential()
+     elif cloud_environment:
+-        from azure.common.credentials import ServicePrincipalCredentials
+-        credentials = ServicePrincipalCredentials(
++        from azure.identity import ClientSecretCredential
++        credentials = ClientSecretCredential(
+             client_id = config.ApplicationId,
+-            secret = config.ApplicationKey,
+-            tenant = config.Tenantid,
++            client_secret = config.ApplicationKey,
++            tenant_id = config.Tenantid,
+             cloud_environment=cloud_environment
+         )
+     else:
+-        from azure.common.credentials import ServicePrincipalCredentials
+-        credentials = ServicePrincipalCredentials(
++        from azure.identity import ClientSecretCredential
++        credentials = ClientSecretCredential(
+             client_id = config.ApplicationId,
+-            secret = config.ApplicationKey,
+-            tenant = config.Tenantid
++            client_secret = config.ApplicationKey,
++            tenant_id = config.Tenantid
+         )
+ 
+     return credentials
+@@ -319,7 +319,8 @@ def get_azure_compute_client(config):
+         compute_client = ComputeManagementClient(
+             credentials,
+             config.SubscriptionId,
+-            base_url=cloud_environment.endpoints.resource_manager
++            base_url=cloud_environment.endpoints.resource_manager,
++            credential_scopes=[cloud_environment.endpoints.resource_manager + "/.default"]
+         )
+     else:
+         compute_client = ComputeManagementClient(
+@@ -338,7 +339,8 @@ def get_azure_network_client(config):
+         network_client = NetworkManagementClient(
+             credentials,
+             config.SubscriptionId,
+-            base_url=cloud_environment.endpoints.resource_manager
++            base_url=cloud_environment.endpoints.resource_manager,
++            credential_scopes=[cloud_environment.endpoints.resource_manager + "/.default"]
+         )
+     else:
+         network_client = NetworkManagementClient(
diff --git a/debian/patches/series b/debian/patches/series
index 3ec598e..01c8c89 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,3 @@
 disable-network-access
 spelling
+azure-sdk-15