Dev: migration: implement corosync.conf migration for corosync 3 (jsc#PED-8252) (#1422)

This pull request implements migrating `corosync.conf` from corosync 2
to corosync 3, including:

* migrate deprecated transport `udpu` and `udp` to `knet`
* replace removed feature _RRP_ with _knet multilink_
* if `crypto_hash` is set to `sha1`, which is the default value in
corosync 2, upgrades it to the new default in corosync 3, `sha256`.

---

# Use Cases

## Check When All Green for Migration

```
> sudo crm cluster health sles16
------ node: localhost ------
[INFO] Checking dependency version...
[INFO] Checking used corosync features...
[WARN] Corosync transport "udpu" will be deprecated in corosync 3. Please use knet.

------ cib ------
[WARN] The CIB is not validated with the latest schema version.
       * Latest version:  3.10
       * Current version: 3.9
[INFO] Checking used resource agents...

------ node: ha-2-2 ------
[WARN] Corosync transport "udpu" will be deprecated in corosync 3. Please use knet.

****** summary ******
[INFO] Please run "crm cluster health sles16 --fix" on on any one of above nodes.
[PASS] This cluster is good to migrate to SLES 16.

```

## Check When Already Migrated

```
> sudo crm cluster health sles16
------ node: localhost ------
[INFO] Checking dependency version...
[INFO] Checking used corosync features...

------ cib ------
[INFO] Checking used resource agents...

------ node: ha-2-2 ------

****** summary ******
[INFO] This cluster works on SLES 16. No migration is needed.
```

## Run Migration

```
> sudo crm cluster health sles16 --fix
suse@ha-2-1:~> sudo crm cluster health sles16 --fix
------ node: localhost ------
[INFO] Checking dependency version...
[INFO] Checking used corosync features...
[WARN] Corosync transport "udpu" will be deprecated in corosync 3. Please use knet.

------ cib ------
[WARN] The CIB is not validated with the latest schema version.
       * Latest version:  3.10
       * Current version: 3.9
[INFO] Checking used resource agents...

------ node: ha-2-2 ------
[WARN] Corosync transport "udpu" will be deprecated in corosync 3. Please use knet.

INFO: Starting migration...
INFO: Migrating corosync configuration...
INFO: Upgrade totem.transport to knet.
INFO: Upgrade totem.crypto_hash from "sha1" to "sha256".
INFO: Finish migrating corosync configuration. The original configuration is renamed to corosync.conf.bak
INFO: Finished migration.
```

## Try to Run Migration When Already Migrated

```
suse@ha-2-1:~> sudo crm cluster health sles16 --fix
------ node: localhost ------
[INFO] Checking dependency version...
[INFO] Checking used corosync features...

------ cib ------
[WARN] The CIB is not validated with the latest schema version.
       * Latest version:  3.10
       * Current version: 3.9
[INFO] Checking used resource agents...

------ node: ha-2-2 ------

INFO: This cluster works on SLES 16 with some warnings. Please fix the remaining warnings manually.
```

Author: liangxin1300

.github/workflows/crmsh-ci.yml

@@ -415,6 +415,21 @@ jobs:
         token: ${{ secrets.CODECOV_TOKEN }}
         flags: integration
 
+  functional_test_migration:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 40
+    steps:
+    - uses: actions/checkout@v4
+    - name: functional test for migration
+      run:  |
+        echo '{ "exec-opts": ["native.cgroupdriver=systemd"] }' | sudo tee /etc/docker/daemon.json
+        sudo systemctl restart docker.service
+        $CONTAINER_SCRIPT `$GET_INDEX_OF migration` && $CONTAINER_SCRIPT -d && $CONTAINER_SCRIPT -u `$GET_INDEX_OF migration`
+    - uses: codecov/codecov-action@v4
+      with:
+        token: ${{ secrets.CODECOV_TOKEN }}
+        flags: integration
+
   original_regression_test:
     runs-on: ubuntu-24.04
     timeout-minutes: 40

MANIFEST.in

@@ -0,0 +1 @@
+recursive-include crmsh *.txt

codecov.yml

@@ -8,7 +8,7 @@ coverage:
         threshold: 0.35%
 codecov:
   notify:
-    after_n_builds: 28
+    after_n_builds: 29
 comment:
-  after_n_builds: 28
+  after_n_builds: 29
   layout: "condensed_header, flags, files, condensed_footer"

crmsh/cibquery.py

@@ -0,0 +1,51 @@
+"""utilities for parsing CIB xml"""
+import dataclasses
+import typing
+
+import lxml.etree
+
+from crmsh import constants
+
+
+@dataclasses.dataclass(frozen=True)
+class ResourceAgent:
+    m_class: str
+    m_provider: typing.Optional[str]
+    m_type: str
+
+
+@dataclasses.dataclass(frozen=True)
+class ClusterNode:
+    node_id: int
+    uname: str
+
+
+def get_configured_resource_agents(cib: lxml.etree.Element) -> typing.Set[ResourceAgent]:
+    return set(
+        ResourceAgent(e.get('class'), e.get('provider'), e.get('type'))
+        for e in cib.xpath('/cib/configuration/resources//primitive')
+    )
+
+
+def has_primitive_filesystem_with_fstype(cib: lxml.etree.Element, fstype: str) -> bool:
+    return bool(cib.xpath(
+        '/cib/configuration/resources//primitive[@class="ocf" and @provider="heartbeat" and @type="Filesystem"]'
+        f'/instance_attributes/nvpair[@name="fstype" and @value="{fstype}"]'
+    ))
+
+def get_cluster_nodes(cib: lxml.etree.Element) -> list[ClusterNode]:
+    """Return a list of cluster nodes, excluding pacemaker-remote nodes"""
+    result = list()
+    for element in cib.xpath(constants.XML_NODE_PATH):
+        node_id = element.get('id')
+        uname = element.get('uname')
+        if element.get('type') == 'remote':
+            xpath = "//primitive[@provider='pacemaker' and @type='remote']/instance_attributes/nvpair[@name='server' and @value='{}']".format(
+                uname if uname is not None else node_id
+            )
+            if cib.xpath(xpath):
+                continue
+        assert node_id
+        assert uname
+        result.append(ClusterNode(int(node_id), uname))
+    return result

crmsh/corosync.py

@@ -85,7 +85,7 @@ def configure_two_node(removing: bool = False, qdevice_adding: bool = False) ->
 
 
 def conf():
-    return os.getenv('COROSYNC_MAIN_CONFIG_FILE', '/etc/corosync/corosync.conf')
+    return os.environ.get('COROSYNC_MAIN_CONFIG_FILE', '/etc/corosync/corosync.conf')
 
 
 def check_tools():

crmsh/migration-supported-resource-agents.txt

@@ -0,0 +1,147 @@
+ocf:heartbeat:CTDB
+ocf:heartbeat:ClusterMon
+ocf:heartbeat:Delay
+ocf:heartbeat:Dummy
+ocf:heartbeat:Filesystem
+ocf:heartbeat:IPaddr2
+ocf:heartbeat:IPsrcaddr
+ocf:heartbeat:IPv6addr
+ocf:heartbeat:LVM-activate
+ocf:heartbeat:MailTo
+ocf:heartbeat:NodeUtilization
+ocf:heartbeat:Raid1
+ocf:heartbeat:Route
+ocf:heartbeat:SAPDatabase
+ocf:heartbeat:SAPInstance
+ocf:heartbeat:SendArp
+ocf:heartbeat:Squid
+ocf:heartbeat:Stateful
+ocf:heartbeat:VirtualDomain
+ocf:heartbeat:WAS
+ocf:heartbeat:WAS6
+ocf:heartbeat:Xinetd
+ocf:heartbeat:aliyun-vpc-move-ip
+ocf:heartbeat:apache
+ocf:heartbeat:aws-vpc-move-ip
+ocf:heartbeat:aws-vpc-route53
+ocf:heartbeat:awseip
+ocf:heartbeat:awsvip
+ocf:heartbeat:azure-events
+ocf:heartbeat:azure-events-az
+ocf:heartbeat:azure-lb
+ocf:heartbeat:conntrackd
+ocf:heartbeat:corosync-qnetd
+ocf:heartbeat:crypt
+ocf:heartbeat:db2
+ocf:heartbeat:dhcpd
+ocf:heartbeat:docker
+ocf:heartbeat:docker-compose
+ocf:heartbeat:dummypy
+ocf:heartbeat:ethmonitor
+ocf:heartbeat:exportfs
+ocf:heartbeat:galera
+ocf:heartbeat:garbd
+ocf:heartbeat:gcp-ilb
+ocf:heartbeat:gcp-pd-move
+ocf:heartbeat:gcp-vpc-move-ip
+ocf:heartbeat:gcp-vpc-move-vip
+ocf:heartbeat:iSCSILogicalUnit
+ocf:heartbeat:iSCSITarget
+ocf:heartbeat:iface-bridge
+ocf:heartbeat:iface-macvlan
+ocf:heartbeat:iface-vlan
+ocf:heartbeat:ldirectord
+ocf:heartbeat:lvmlockd
+ocf:heartbeat:mariadb
+ocf:heartbeat:mdraid
+ocf:heartbeat:mpathpersist
+ocf:heartbeat:mysql
+ocf:heartbeat:mysql-proxy
+ocf:heartbeat:named
+ocf:heartbeat:nfsnotify
+ocf:heartbeat:nfsserver
+ocf:heartbeat:nginx
+ocf:heartbeat:nvmet-namespace
+ocf:heartbeat:nvmet-port
+ocf:heartbeat:nvmet-subsystem
+ocf:heartbeat:oraasm
+ocf:heartbeat:oracle
+ocf:heartbeat:oralsnr
+ocf:heartbeat:osceip
+ocf:heartbeat:ovsmonitor
+ocf:heartbeat:pgagent
+ocf:heartbeat:pgsql
+ocf:heartbeat:podman
+ocf:heartbeat:portblock
+ocf:heartbeat:postfix
+ocf:heartbeat:powervs-subnet
+ocf:heartbeat:rabbitmq-cluster
+ocf:heartbeat:rabbitmq-server-ha
+ocf:heartbeat:redis
+ocf:heartbeat:rsyncd
+ocf:heartbeat:sfex
+ocf:heartbeat:sg_persist
+ocf:heartbeat:slapd
+ocf:heartbeat:storage-mon
+ocf:heartbeat:symlink
+ocf:heartbeat:tomcat
+ocf:suse:aws-vpc-move-ip
+ocf:suse:SAPHanaController
+ocf:suse:SAPHanaFilesystem
+ocf:suse:SAPHanaTopology
+stonith:fence_aliyun
+stonith:fence_alom
+stonith:fence_apc
+stonith:fence_apc-snmp
+stonith:fence_aws
+stonith:fence_azure-arm
+stonith:fence_bladecenter
+stonith:fence_brocade
+stonith:fence_cisco-mds
+stonith:fence_cisco-ucs
+stonith:fence_compute
+stonith:fence_docker
+stonith:fence_drac5
+stonith:fence_eaton-snmp
+stonith:fence_eaton-ssh
+stonith:fence_emerson
+stonith:fence_eps
+stonith:fence_gce
+stonith:fence_hds-cb
+stonith:fence_hpblade
+stonith:fence_ibm-powervs
+stonith:fence_ibm-vpc
+stonith:fence_ibmblade
+stonith:fence_ibmz
+stonith:fence_ifmib
+stonith:fence_ilo-moonshot
+stonith:fence_ilo-mp
+stonith:fence_ilo-ssh
+stonith:fence_ilo2
+stonith:fence_intelmodular
+stonith:fence_ipdu
+stonith:fence_ipmilan
+stonith:fence_ironic
+stonith:fence_kdump
+stonith:fence_ldom
+stonith:fence_lpar
+stonith:fence_mpath
+stonith:fence_netio
+stonith:fence_openstack
+stonith:fence_pve
+stonith:fence_raritan
+stonith:fence_rcd-serial
+stonith:fence_redfish
+stonith:fence_rhevm
+stonith:fence_rsa
+stonith:fence_rsb
+stonith:fence_sanbox2
+stonith:fence_sbd
+stonith:fence_scsi
+stonith:fence_vbox
+stonith:fence_virsh
+stonith:fence_vmware
+stonith:fence_vmware-rest
+stonith:fence_wti
+stonith:fence_xenapi
+stonith:fence_zvm