[PATCH container v3 21/21] migration: intra-cluster: check config can be parsed on target node

[Fiona Ebner <f.ebner@proxmox.com>]

For remote migration, we already check that the config can be parsed
on the target. Do the same for intra-cluster migration, to avoid
issues with future new settings unexpectedly being ignored if the
target is too old. For example, migrating a container with a
mountpoint with 'keepattrs' to a node with a too old pve-container
version, results in the mountpoint not being mounted on the target.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---

The node version might need to be adapted when applying!

Changes in v3:
* add skip-config-check flag rather than re-using force.
* check node version to decide if too old or not.

 src/PVE/API2/LXC.pm    | 13 ++++++++++++-
 src/PVE/LXC/Migrate.pm | 30 ++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
index c89837e..c5e3b04 100644
--- a/src/PVE/API2/LXC.pm
+++ b/src/PVE/API2/LXC.pm
@@ -82,12 +82,23 @@ my $migrate_json_properties = {
         minimum => '0',
         default => 'migrate limit from datacenter or storage config',
     },
+    'skip-config-check' => {
+        type => 'boolean',
+        optional => 1,
+        default => 0,
+        description =>
+            'For intra-cluster migration. Skip checking if the configuration can be parsed'
+            . ' successfully by the target. Using this flag can lead to ignored'
+            . ' configuration options if the target is too old to parse them.',
+    },
 };
 
 # Properties that will be forwarded via the HA stack to the LRM, which will then use them for its
 # own invocation of the migration API endpoint. The other properties are not forwarded and lost for
 # HA migrations with many being hard-coded for the LRM invocation.
-my $ha_migrate_props = {};
+my $ha_migrate_props = {
+    'skip-config-check' => 1,
+};
 
 sub ha_migrate_json_properties {
     my $forwarded_props = {};
diff --git a/src/PVE/LXC/Migrate.pm b/src/PVE/LXC/Migrate.pm
index d243d90..a8d3a3d 100644
--- a/src/PVE/LXC/Migrate.pm
+++ b/src/PVE/LXC/Migrate.pm
@@ -159,6 +159,36 @@ sub prepare {
         my $cmd = [@{ $self->{rem_ssh} }, '/bin/true'];
         eval { $self->cmd_quiet($cmd); };
         die "Can't connect to destination address using public key\n" if $@;
+
+        if (!$self->{opts}->{'skip-config-check'}) {
+            if (PVE::Cluster::node_pvecfg_version_at_least($self->{node}, 9, 2, 21)) {
+                # Fork a short-lived tunnel for checking the config. Later, the proper tunnel with
+                # SSH forwarding info is forked.
+                my $tunnel = PVE::Tunnel::fork_ssh_tunnel(
+                    $self->{rem_ssh},
+                    ['pct', 'mtunnel'],
+                    undef,
+                    sub {
+                        my ($level, $msg) = @_;
+                        $self->log($level, $msg);
+                    },
+                );
+                eval {
+                    my $nodename = PVE::INotify::nodename();
+                    PVE::Tunnel::write_tunnel($tunnel, 30, "config $vmid $nodename");
+                };
+                my $err = $@;
+
+                eval { PVE::Tunnel::finish_tunnel($tunnel); };
+                $self->log('warn', "failed to finish tunnel in prepare() - $@") if $@;
+
+                die "$err - use 'skip-config-check' flag to migrate regardless\n" if $err;
+            } else {
+                $self->log('info', "skipping config check - target pve-manager version < 9.2.21");
+            }
+        } else {
+            $self->log('info', "skipping config check - override option is set");
+        }
     }
 
     # in restart mode, we shutdown the container before migrating
-- 
2.47.3