From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <pve-devel-bounces@lists.proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
by lore.proxmox.com (Postfix) with ESMTPS id 9A5F81FF164
for <inbox@lore.proxmox.com>; Fri, 28 Feb 2025 14:06:48 +0100 (CET)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id 1B22DE198;
Fri, 28 Feb 2025 14:06:25 +0100 (CET)
From: Stefan Hanreich <s.hanreich@proxmox.com>
To: pve-devel@lists.proxmox.com
Date: Fri, 28 Feb 2025 14:05:48 +0100
Message-Id: <20250228130549.100357-6-s.hanreich@proxmox.com>
X-Mailer: git-send-email 2.39.5
In-Reply-To: <20250228130549.100357-1-s.hanreich@proxmox.com>
References: <20250228130549.100357-1-s.hanreich@proxmox.com>
MIME-Version: 1.0
X-SPAM-LEVEL: Spam detection results: 0
AWL -0.389 Adjusted score from AWL reputation of From: address
BAYES_00 -1.9 Bayes spam probability is 0 to 1%
DMARC_MISSING 0.1 Missing DMARC policy
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery
methods POISEN_SPAM_PILL 0.1 Meta: its spam
POISEN_SPAM_PILL_1 0.1 random spam to be learned in bayes
POISEN_SPAM_PILL_3 0.1 random spam to be learned in bayes
RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_NONE 0.001 SPF: sender does not publish an SPF Record
Subject: [pve-devel] [PATCH pve-network 4/5] api: add lock and release
endpoints for global configuration lock
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
Reply-To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: pve-devel-bounces@lists.proxmox.com
Sender: "pve-devel" <pve-devel-bounces@lists.proxmox.com>
This endpoint exposes the newly introduced global lock functionality
via the API. It adds endpoints for acquiring and releasing the lock.
Acquiring the lock is as simple as:
pvesh create /cluster/sdn/lock
The flag 'allow-pending' governs whether the lock should be acquired
if there are pending configuration changes.
The release endpoint can also be used to forcibly release the lock via
CLI without requiring the knowledge of the lock-secret:
pvesh delete /cluster/sdn/lock --force 1
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
src/PVE/API2/Network/SDN.pm | 81 +++++++++++++++++++++++++++++++++++++
src/PVE/Network/SDN.pm | 23 +++++++++++
2 files changed, 104 insertions(+)
diff --git a/src/PVE/API2/Network/SDN.pm b/src/PVE/API2/Network/SDN.pm
index b09a54b..3377f76 100644
--- a/src/PVE/API2/Network/SDN.pm
+++ b/src/PVE/API2/Network/SDN.pm
@@ -99,6 +99,87 @@ my $create_reload_network_worker = sub {
return $res->{pid};
};
+__PACKAGE__->register_method({
+ name => 'lock',
+ protected => 1,
+ path => 'lock',
+ method => 'POST',
+ description => "Acquire global lock for SDN configuration",
+ permissions => {
+ check => ['perm', '/sdn', ['SDN.Allocate']],
+ },
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ 'allow-pending' => {
+ type => 'boolean',
+ optional => 1,
+ default => 0,
+ description => 'if true, allow acquiring lock even though there are pending changes'
+ }
+ },
+ },
+ returns => {
+ type => 'string',
+ },
+ code => sub {
+ my ($param) = @_;
+
+ return PVE::Network::SDN::lock_sdn_config(
+ sub {
+ die "configuration has pending changes"
+ if !$param->{'allow-pending'} && PVE::Network::SDN::has_pending_changes();
+
+ return PVE::Network::SDN::create_global_lock();
+ },
+ "could not acquire lock for SDN config"
+ );
+ }
+});
+
+__PACKAGE__->register_method({
+ name => 'release_lock',
+ protected => 1,
+ path => 'lock',
+ method => 'DELETE',
+ description => "Release global lock for SDN configuration",
+ permissions => {
+ check => ['perm', '/sdn', ['SDN.Allocate']],
+ },
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
+ 'force' => {
+ type => 'boolean',
+ optional => 1,
+ default => 0,
+ description => 'if true, allow releasing lock without providing the secret'
+ }
+ },
+ },
+ returns => {
+ type => 'null',
+ },
+ code => sub {
+ my ($param) = @_;
+
+ my $code = sub {
+ PVE::Network::SDN::delete_global_lock();
+ };
+
+ if ($param->{force}) {
+ $code->();
+ } else {
+ PVE::Network::SDN::lock_sdn_config(
+ $code,
+ "could not release lock",
+ $param->{'lock-secret'}
+ );
+ }
+ }
+});
+
__PACKAGE__->register_method ({
name => 'reload',
protected => 1,
diff --git a/src/PVE/Network/SDN.pm b/src/PVE/Network/SDN.pm
index 08c8700..0f6754a 100644
--- a/src/PVE/Network/SDN.pm
+++ b/src/PVE/Network/SDN.pm
@@ -173,6 +173,29 @@ sub commit_config {
cfs_write_file($running_cfg, $cfg);
}
+sub has_pending_changes {
+ my $running_cfg = PVE::Network::SDN::running_config();
+
+ # only use configuration files which get written by commit_config here
+ my $config_files = {
+ zones => PVE::Network::SDN::Zones::config(),
+ vnets => PVE::Network::SDN::Vnets::config(),
+ subnets => PVE::Network::SDN::Subnets::config(),
+ controllers => PVE::Network::SDN::Controllers::config(),
+ };
+
+ for my $config_file (keys %$config_files) {
+ my $config = $config_files->{$config_file};
+ my $pending_config = PVE::Network::SDN::pending_config($running_cfg, $config, $config_file);
+
+ for my $id (keys %{$pending_config->{ids}}) {
+ return 1 if $pending_config->{ids}->{$id}->{pending};
+ }
+ }
+
+ return 0;
+}
+
sub generate_lock_secret {
my $min = ord('!'); # first printable ascii
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel