Skip to content

Commit c3297df

Browse files
authored
Merge pull request #3783 from kgaillot/release3
Backport a few commits for 3.0.0 final release
2 parents 2587987 + ea46351 commit c3297df

File tree

10 files changed

+151
-66
lines changed

10 files changed

+151
-66
lines changed

Diff for: INSTALL.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
| 3.6 or later | python3 | python3 | python3 |
1919
| 0.18 or later | gettext-devel | gettext-tools | gettext |
2020
| 0.18 or later | | | autopoint |
21-
| 3.1.7 or later | gnutls-devel | libgnutls-devel | libgnutls-dev |
21+
| 3.4.6 or later | gnutls-devel | libgnutls-devel | libgnutls-dev |
2222

2323
Also:
2424
* make must be GNU (or compatible) (setting MAKE=gmake might also work but is

Diff for: configure.ac

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
dnl
22
dnl autoconf for Pacemaker
33
dnl
4-
dnl Copyright 2009-2024 the Pacemaker project contributors
4+
dnl Copyright 2009-2025 the Pacemaker project contributors
55
dnl
66
dnl The version control history for this file may have further details.
77
dnl
@@ -1565,7 +1565,7 @@ dnl ========================================================================
15651565
dnl GnuTLS
15661566
dnl ========================================================================
15671567

1568-
PKG_CHECK_MODULES(GNUTLS, [gnutls >= 3.1.7],
1568+
PKG_CHECK_MODULES(GNUTLS, [gnutls >= 3.4.6],
15691569
[CPPFLAGS="${CPPFLAGS} ${GNUTLS_CFLAGS}"
15701570
LIBS="${LIBS} ${GNUTLS_LIBS}"])
15711571

Diff for: doc/sphinx/Pacemaker_Administration/configuring.rst

+6-3
Original file line numberDiff line numberDiff line change
@@ -229,9 +229,9 @@ To use TLS certificates, the administrator's machine also needs their
229229
public/private key pair, signed client certificate, and root CA certificate.
230230
Those must additionally be specified with the following environment variables:
231231

232-
* :ref:`CIB_ca_file <file>`
233-
* :ref:`CIB_cert_file <file>`
234-
* :ref:`CIB_key_file <file>`
232+
* :ref:`CIB_ca_file <CIB_ca_file>`
233+
* :ref:`CIB_cert_file <CIB_cert_file>`
234+
* :ref:`CIB_key_file <CIB_key_file>`
235235

236236
As an example, if **node1** is a cluster node, and the CIB is configured with
237237
``remote-tls-port`` set to 1234, the administrator could read the current
@@ -246,6 +246,9 @@ the daemon user's password:
246246
# export CIB_key_file=/etc/pacemaker/admin.key.pem
247247
# cibadmin -Q
248248
249+
Optionally, :ref:`CIB_crl_file <CIB_crl_file>` may be set to the location of a
250+
Certificate Revocation List in PEM format.
251+
249252
.. note::
250253

251254
Pacemaker must have been built with PAM support for remote access to work.

Diff for: doc/sphinx/Pacemaker_Administration/options.rst

+54
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,60 @@ Pacemaker uses several environment variables set on the client side.
7272
- The host to connect to. Used with :ref:`CIB_port <CIB_port>` for
7373
connecting to a remote CIB instance; ignored if
7474
:ref:`CIB_port <CIB_port>` is not set.
75+
* - .. _CIB_ca_file:
76+
77+
.. index::
78+
single: CIB_ca_file
79+
single: environment variable; CIB_ca_file
80+
81+
CIB_ca_file
82+
-
83+
- If this, :ref:`CIB_cert_file <CIB_cert_file>`, and
84+
:ref:`CIB_key_file <CIB_key_file>` are set, remote CIB administration
85+
will be encrypted using X.509 (SSL/TLS) certificates, with this root
86+
certificate for the certificate authority. Used with :ref:`CIB_port
87+
<CIB_port>` for connecting to a remote CIB instance; ignored if
88+
:ref:`CIB_port <CIB_port>` is not set.
89+
* - .. _CIB_cert_file:
90+
91+
.. index::
92+
single: CIB_cert_file
93+
single: environment variable; CIB_cert_file
94+
95+
CIB_cert_file
96+
-
97+
- If this, :ref:`CIB_ca_file <CIB_ca_file>`, and
98+
:ref:`CIB_key_file <CIB_key_file>` are set, remote CIB administration
99+
will be encrypted using X.509 (SSL/TLS) certificates, with this
100+
certificate for the local host. Used with :ref:`CIB_port <CIB_port>` for
101+
connecting to a remote CIB instance; ignored if
102+
:ref:`CIB_port <CIB_port>` is not set.
103+
* - .. _CIB_key_file:
104+
105+
.. index::
106+
single: CIB_key_file
107+
single: environment variable; CIB_key_file
108+
109+
CIB_key_file
110+
-
111+
- If this, :ref:`CIB_ca_file <CIB_ca_file>`, and
112+
:ref:`CIB_cert_file <CIB_cert_file>` are set, remote CIB administration
113+
will be encrypted using X.509 (SSL/TLS) certificates, with this
114+
private key for the local host. Used with :ref:`CIB_port <CIB_port>` for
115+
connecting to a remote CIB instance; ignored if
116+
:ref:`CIB_port <CIB_port>` is not set.
117+
* - .. _CIB_crl_file:
118+
119+
.. index::
120+
single: CIB_crl_file
121+
single: environment variable; CIB_crl_file
122+
123+
CIB_crl_file
124+
-
125+
- If this, :ref:`CIB_ca_file <CIB_ca_file>`,
126+
:ref:`CIB_cert_file <CIB_cert_file>`, and
127+
:ref:`CIB_key_file <CIB_key_file>` are all set, then certificates listed
128+
in this PEM-format Certificate Revocation List file will be rejected.
75129
* - .. _CIB_shadow:
76130

77131
.. index::

Diff for: doc/sphinx/Pacemaker_Development/components.rst

+74-51
Original file line numberDiff line numberDiff line change
@@ -341,16 +341,13 @@ Working with the scheduler is difficult. Challenges include:
341341
later. For example, data unpacked from the CIB can safely be used anytime
342342
after ``unpack_cib(),`` but actions may become optional or required anytime
343343
before ``pcmk__create_graph()``. There's no easy way to deal with this.
344-
* Many names of struct members, functions, etc., are suboptimal, but are part
345-
of the public API and cannot be changed until an API backward compatibility
346-
break.
347344

348345

349346
.. index::
350347
single: pcmk_scheduler_t
351348

352-
Cluster Working Set
353-
___________________
349+
The Scheduler Object
350+
____________________
354351

355352
The main data object for the scheduler is ``pcmk_scheduler_t``, which contains
356353
all information needed about nodes, resources, constraints, etc., both as the
@@ -363,18 +360,21 @@ transition graph XML. The variable name is usually ``scheduler``.
363360
Resources
364361
_________
365362

366-
``pcmk_resource_t`` is the data object representing cluster resources. A
367-
resource has a variant: :term:`primitive`, group, clone, or :term:`bundle`.
363+
``pcmk_resource_t`` is the data object representing cluster resources. It has a
364+
couple of public members for backward compatibility reasons, but most of the
365+
implementation is in the internal ``pcmk__resource_private_t`` type.
368366

369-
The resource object has members for two sets of methods,
370-
``resource_object_functions_t`` from the ``libpe_status`` public API, and
371-
``resource_alloc_functions_t`` whose implementation is internal to
367+
A resource has a variant: :term:`primitive`, group, clone, or :term:`bundle`.
368+
369+
The private resource object has members for two sets of methods,
370+
``pcmk__rsc_methods_t`` from ``libcrmcommon``, and
371+
``pcmk__assignment_methods_t`` whose implementation is internal to
372372
``libpacemaker``. The actual functions vary by variant.
373373

374-
The object functions have basic capabilities such as unpacking the resource
374+
The resource methods have basic capabilities such as unpacking the resource
375375
XML, and determining the current or planned location of the resource.
376376

377-
The :term:`assignment <assign>` functions have more obscure capabilities needed
377+
The :term:`assignment <assign>` methods have more obscure capabilities needed
378378
for scheduling, such as processing location and ordering constraints. For
379379
example, ``pcmk__create_internal_constraints()`` simply calls the
380380
``internal_constraints()`` method for each top-level resource in the cluster.
@@ -390,25 +390,33 @@ with the highest :term:`score` for a given resource. The scheduler does a bunch
390390
of processing to generate the scores, then the actual assignment is
391391
straightforward.
392392

393+
The scheduler node implementation is a little confusing.
394+
395+
``pcmk_node_t`` (``struct pcmk__scored_node``) is the primary object used.
396+
397+
It contains two sub-structs, ``pcmk__node_private_t *priv`` (which is internal)
398+
and ``struct pcmk__node_details *details`` (which is public for backward
399+
compatibility reasons), that contain all node information that is independent
400+
of resource assignment (the node name, etc.).
401+
402+
It contains one other (internal) sub-struct, ``struct pcmk__node_assignment
403+
*assign``, which contains information particular to a specific resource being
404+
assigned.
405+
393406
Node lists are frequently used. For example, ``pcmk_scheduler_t`` has a
394-
``nodes`` member which is a list of all nodes in the cluster, and
395-
``pcmk_resource_t`` has a ``running_on`` member which is a list of all nodes on
396-
which the resource is (or might be) active. These are lists of ``pcmk_node_t``
397-
objects.
407+
``nodes`` member which is a list of all nodes in the cluster, and the internal
408+
resource object has an ``active_nodes`` member which is a list of all nodes on
409+
which the resource is (or might be) active.
398410

399-
The ``pcmk_node_t`` object contains a ``struct pe_node_shared_s *details``
400-
member with all node information that is independent of resource assignment
401-
(the node name, etc.).
411+
Only the scheduler's ``nodes`` list has the full, original node instances. All
412+
other node lists have shallow copies created by ``pe__copy_node()``, which
413+
share ``details`` and ``priv`` from the main list (but can differ in their
414+
``assign`` member).
402415

403-
The working set's ``nodes`` member contains the original of this information.
404-
All other node lists contain copies of ``pcmk_node_t`` where only the
405-
``details`` member points to the originals in the working set's ``nodes`` list.
406-
In this way, the other members of ``pcmk_node_t`` (such as ``weight``, which is
407-
the node score) may vary by node list, while the common details are shared.
408416

409417
.. index::
410418
single: pcmk_action_t
411-
single: pe_action_flags
419+
single: pcmk__action_flags
412420

413421
Actions
414422
_______
@@ -418,16 +426,16 @@ taken. These could be resource actions, cluster-wide actions such as fencing a
418426
node, or "pseudo-actions" which are abstractions used as convenient points for
419427
ordering other actions against.
420428

421-
It has a ``flags`` member which is a bitmask of ``enum pe_action_flags``. The
422-
most important of these are ``pe_action_runnable`` (if not set, the action is
423-
"blocked" and cannot be added to the transition graph) and
424-
``pe_action_optional`` (actions with this set will not be added to the
425-
transition graph; actions often start out as optional, and may become required
426-
later).
429+
Its (internal) implementation has a ``flags`` member which is a bitmask of
430+
``enum pcmk__action_flags``. The most important of these are
431+
``pcmk__action_runnable`` (if not set, the action is "blocked" and cannot be
432+
added to the transition graph) and ``pcmk__action_optional`` (actions with this
433+
set will not be added to the transition graph; actions often start out as
434+
optional, and may become required later).
427435

428436

429437
.. index::
430-
single: pe__colocation_t
438+
single: pcmk__colocation_t
431439

432440
Colocations
433441
___________
@@ -462,30 +470,45 @@ The resource assignment functions have several methods related to colocations:
462470

463471

464472
.. index::
465-
single: pe__ordering_t
466-
single: pe_ordering
473+
single: pcmk__action_relation_t
474+
single: action; relation
467475

468-
Orderings
469-
_________
476+
Action Relations
477+
________________
470478

471479
Ordering constraints are simple in concept, but they are one of the most
472480
important, powerful, and difficult to follow aspects of the scheduler code.
473481

474-
``pe__ordering_t`` is the data object representing an ordering, better thought
475-
of as a relationship between two actions, since the relation can be more
476-
complex than just "this one runs after that one".
482+
``pcmk__action_relation_t`` is the data object representing an ordering, better
483+
thought of as a relationship between two actions, since the relation can be
484+
more complex than just "this one runs after that one".
477485

478-
For an ordering "A then B", the code generally refers to A as "first" or
486+
For a relation "A then B", the code generally refers to A as "first" or
479487
"before", and B as "then" or "after".
480488

481-
Much of the power comes from ``enum pe_ordering``, which are flags that
482-
determine how an ordering behaves. There are many obscure flags with big
483-
effects. A few examples:
484-
485-
* ``pe_order_none`` means the ordering is disabled and will be ignored. It's 0,
486-
meaning no flags set, so it must be compared with equality rather than
487-
``pcmk_is_set()``.
488-
* ``pe_order_optional`` means the ordering does not make either action
489-
required, so it only applies if they both become required for other reasons.
490-
* ``pe_order_implies_first`` means that if action B becomes required for any
491-
reason, then action A will become required as well.
489+
Much of the power comes from ``enum pcmk__action_relation_flags``, which are
490+
flags that determine how a relation behaves. There are many obscure flags with
491+
big effects. A few examples:
492+
493+
* ``pcmk__ar_none`` means the relation is disabled and will be ignored. The
494+
value is 0, meaning no flags set, so it must be compared with equality rather
495+
than ``pcmk_is_set()``.
496+
* ``pcmk__ar_ordered`` without any other flags set means the relation does not
497+
make either action required, so it applies only if they both become required
498+
for other reasons.
499+
* ``pcmk__ar_then_implies_first`` means that if action B becomes required for
500+
any reason, then action A will become required as well.
501+
502+
Adding a New Scheduler Regression Test
503+
______________________________________
504+
505+
#. Choose a test name.
506+
#. Copy the uncompressed input CIB to cts/scheduler/xml/TESTNAME.xml. It's
507+
helpful to add an XML comment at the top describing the essential features of
508+
the test (which configuration and status scenarios are being tested).
509+
#. Edit ``cts/cts-scheduler.in`` and add the test name and description to the
510+
``TESTS`` array.
511+
#. Run ``cts/cts-scheduler --update --run TESTNAME`` to generate the expected
512+
transition graph, scores, etc. Look over the generated files to make sure
513+
they are as expected.
514+
#. Commit your changes.

Diff for: doc/sphinx/Pacemaker_Development/python.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ or "GNU Lesser General Public License version 2.1 or later (LGPLv2.1+)".
5454
Python Version Compatibility
5555
############################
5656

57-
Pacemaker targets compatibility with Python 3.4 and later.
57+
Pacemaker targets compatibility with Python 3.6 and later.
5858

5959
Do not use features not available in all targeted Python versions. An
6060
example is the ``subprocess.run()`` function.

Diff for: doc/sphinx/Pacemaker_Explained/collective.rst

+4-4
Original file line numberDiff line numberDiff line change
@@ -251,10 +251,10 @@ _____________
251251
| globally-unique | **true** if | .. index:: |
252252
| | clone-node-max | single: clone; option, globally-unique |
253253
| | is greater than | single: option; globally-unique (clone) |
254-
| | 1, otherwise | single: globally-unique; clone option |
255-
| | **false** | |
256-
| | | If **true**, each clone instance performs a |
257-
| | | distinct function, such that a single node can run |
254+
| | 1 *(since* | single: globally-unique; clone option |
255+
| | *3.0.0)*, | |
256+
| | otherwise | If **true**, each clone instance performs a |
257+
| | **false** | distinct function, such that a single node can run |
258258
| | | more than one instance at the same time |
259259
+-------------------+-----------------+-------------------------------------------------------+
260260
| clone-max | 0 | .. index:: |

Diff for: python/pylintrc

+1-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ extension-pkg-allow-list=
4545

4646
# Minimum supported python version
4747
# CHANGED
48-
py-version = 3.4
48+
py-version = 3.6
4949

5050
# Control the amount of potential inferred values when inferring a single
5151
# object. This can help the performance when dealing with large functions or

Diff for: rpm/pacemaker.spec.in

+5-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#
2-
# Copyright 2008-2024 the Pacemaker project contributors
2+
# Copyright 2008-2025 the Pacemaker project contributors
33
#
44
# The version control history for this file may have further details.
55
#
@@ -270,7 +270,7 @@ BuildRequires: sed
270270

271271
# Required for core functionality
272272
BuildRequires: pkgconfig(glib-2.0) >= 2.42
273-
BuildRequires: pkgconfig(gnutls) >= 3.1.7
273+
BuildRequires: pkgconfig(gnutls) >= 3.4.6
274274
BuildRequires: pkgconfig(libxml-2.0) >= 2.9.2
275275
BuildRequires: pkgconfig(systemd)
276276
BuildRequires: libxslt-devel
@@ -624,7 +624,6 @@ exit 0
624624
%files
625625
###########################################################
626626
%config(noreplace) %{_sysconfdir}/sysconfig/pacemaker
627-
%config(noreplace) %{_sysconfdir}/logrotate.d/pacemaker
628627
%{_sbindir}/pacemakerd
629628
%{_unitdir}/pacemaker.service
630629

@@ -660,8 +659,11 @@ exit 0
660659
%{ocf_root}/resource.d/pacemaker/controld
661660
%{ocf_root}/resource.d/pacemaker/remote
662661

662+
# The logrotate script is here rather than the main pacemaker package so
663+
# pacemaker-remoted can use it
663664
%files cli
664665
%dir %attr (750, root, %{gname}) %{_sysconfdir}/pacemaker
666+
%config(noreplace) %{_sysconfdir}/logrotate.d/pacemaker
665667
%config(noreplace) %{_sysconfdir}/sysconfig/crm_mon
666668

667669
%{_unitdir}/crm_mon.service

Diff for: rpm/rpmlintrc

+3
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ addFilter("E: hardcoded-library-path in /usr/lib/os-release")
77
# When building developer packages
88
addFilter("W: invalid-url Source0:")
99

10+
# rpmlint doesn't like logrotate script being in pacemaker-cli package
11+
addFilter("E: incoherent-logrotate-file /etc/logrotate.d/pacemaker")
12+
1013
# pacemaker_remote scriptlets use a state file
1114
addFilter("W: dangerous-command-in-%(pre|postun|posttrans) rm")
1215

0 commit comments

Comments
 (0)