[pve-devel] [PATCH network v2 4/5] api: add lock and release endpoints for global configuration lock

[Gabriel Goller]

From: Stefan Hanreich <s.hanreich at proxmox.com>

This endpoint exposes the newly introduced global lock functionality
via the API. It adds endpoints for acquiring and releasing the lock.
Acquiring the lock is as simple as:

  pvesh create /cluster/sdn/lock

The flag 'allow-pending' governs whether the lock should be acquired
if there are pending configuration changes.

The release endpoint can also be used to forcibly release the lock via
CLI without requiring the knowledge of the lock-secret:

  pvesh delete /cluster/sdn/lock --force 1

Co-authored-by: Gabriel Goller <g.goller at proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich at proxmox.com>
---
 src/PVE/API2/Network/SDN.pm | 82 +++++++++++++++++++++++++++++++++++++
 src/PVE/Network/SDN.pm      | 23 +++++++++++
 2 files changed, 105 insertions(+)

diff --git a/src/PVE/API2/Network/SDN.pm b/src/PVE/API2/Network/SDN.pm
index dc271ec4fbf9..692dec8718f7 100644
--- a/src/PVE/API2/Network/SDN.pm
+++ b/src/PVE/API2/Network/SDN.pm
@@ -116,6 +116,88 @@ my $create_reload_network_worker = sub {
 };
 
 __PACKAGE__->register_method({
+    name => 'lock',
+    protected => 1,
+    path => 'lock',
+    method => 'POST',
+    description => "Acquire global lock for SDN configuration",
+    permissions => {
+        check => ['perm', '/sdn', ['SDN.Allocate']],
+    },
+    parameters => {
+        additionalProperties => 0,
+        properties => {
+            'allow-pending' => {
+                type => 'boolean',
+                optional => 1,
+                default => 0,
+                description =>
+                    'if true, allow acquiring lock even though there are pending changes',
+            },
+        },
+    },
+    returns => {
+        type => 'string',
+    },
+    code => sub {
+        my ($param) = @_;
+
+        return PVE::Network::SDN::lock_sdn_config(
+            sub {
+                die "configuration has pending changes"
+                    if !$param->{'allow-pending'} && PVE::Network::SDN::has_pending_changes();
+
+                return PVE::Network::SDN::create_global_lock();
+            },
+            "could not acquire lock for SDN config",
+        );
+    },
+});
+
+__PACKAGE__->register_method({
+    name => 'release_lock',
+    protected => 1,
+    path => 'lock',
+    method => 'DELETE',
+    description => "Release global lock for SDN configuration",
+    permissions => {
+        check => ['perm', '/sdn', ['SDN.Allocate']],
+    },
+    parameters => {
+        additionalProperties => 0,
+        properties => {
+            'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
+            'force' => {
+                type => 'boolean',
+                optional => 1,
+                default => 0,
+                description => 'if true, allow releasing lock without providing the secret',
+            },
+        },
+    },
+    returns => {
+        type => 'null',
+    },
+    code => sub {
+        my ($param) = @_;
+
+        my $code = sub {
+            PVE::Network::SDN::delete_global_lock();
+        };
+
+        if ($param->{force}) {
+            $code->();
+        } else {
+            PVE::Network::SDN::lock_sdn_config(
+                $code,
+                "could not release lock",
+                $param->{'lock-secret'},
+            );
+        }
+    },
+});
+
+__PACKAGE__->register_method ({
     name => 'reload',
     protected => 1,
     path => '',
diff --git a/src/PVE/Network/SDN.pm b/src/PVE/Network/SDN.pm
index adcae175aa2d..59185bfd5a16 100644
--- a/src/PVE/Network/SDN.pm
+++ b/src/PVE/Network/SDN.pm
@@ -208,6 +208,29 @@ sub commit_config {
     cfs_write_file($running_cfg, $cfg);
 }
 
+sub has_pending_changes {
+    my $running_cfg = PVE::Network::SDN::running_config();
+
+    # only use configuration files which get written by commit_config here
+    my $config_files = {
+        zones => PVE::Network::SDN::Zones::config(),
+        vnets => PVE::Network::SDN::Vnets::config(),
+        subnets => PVE::Network::SDN::Subnets::config(),
+        controllers => PVE::Network::SDN::Controllers::config(),
+    };
+
+    for my $config_file (keys %$config_files) {
+        my $config = $config_files->{$config_file};
+        my $pending_config = PVE::Network::SDN::pending_config($running_cfg, $config, $config_file);
+
+        for my $id (keys %{ $pending_config->{ids} }) {
+            return 1 if $pending_config->{ids}->{$id}->{pending};
+        }
+    }
+
+    return 0;
+}
+
 sub generate_lock_secret {
     my $min = ord('!'); # first printable ascii
 
-- 
2.39.5