[pve-devel] [RFC ha-manager v5 20/23] api: groups: disallow calls to ha groups endpoints if fully migrated

[Daniel Kral]

Disallow calls to the HA groups API endpoints as soon as the HA groups
config has been migrated (i.e. no entries or deleted), because HA groups
are deprecated and new users are pushed to use the new HA rules feature
instead.

Signed-off-by: Daniel Kral <d.kral at proxmox.com>
---
should we die for the reading api endpoints here?

 src/PVE/API2/HA/Groups.pm | 25 ++++++++++++++++++++-----
 src/PVE/HA/Config.pm      |  9 +++++++++
 2 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/src/PVE/API2/HA/Groups.pm b/src/PVE/API2/HA/Groups.pm
index 32350df9..4412d542 100644
--- a/src/PVE/API2/HA/Groups.pm
+++ b/src/PVE/API2/HA/Groups.pm
@@ -36,7 +36,7 @@ __PACKAGE__->register_method({
     name => 'index',
     path => '',
     method => 'GET',
-    description => "Get HA groups.",
+    description => "Get HA groups. (deprecated in favor of HA rules)",
     permissions => {
         check => ['perm', '/', ['Sys.Audit']],
     },
@@ -57,6 +57,9 @@ __PACKAGE__->register_method({
 
         my $cfg = PVE::HA::Config::read_group_config();
 
+        die "cannot index groups: ha groups have been migrated to rules\n"
+            if PVE::HA::Config::have_groups_been_migrated($cfg);
+
         my $res = [];
         foreach my $group (keys %{ $cfg->{ids} }) {
             my $scfg = &$api_copy_config($cfg, $group);
@@ -72,7 +75,7 @@ __PACKAGE__->register_method({
     name => 'read',
     path => '{group}',
     method => 'GET',
-    description => "Read ha group configuration.",
+    description => "Read ha group configuration. (deprecated in favor of HA rules)",
     permissions => {
         check => ['perm', '/', ['Sys.Audit']],
     },
@@ -91,6 +94,9 @@ __PACKAGE__->register_method({
 
         my $cfg = PVE::HA::Config::read_group_config();
 
+        die "cannot read group: ha groups have been migrated to rules\n"
+            if PVE::HA::Config::have_groups_been_migrated($cfg);
+
         return &$api_copy_config($cfg, $param->{group});
     },
 });
@@ -100,7 +106,7 @@ __PACKAGE__->register_method({
     protected => 1,
     path => '',
     method => 'POST',
-    description => "Create a new HA group.",
+    description => "Create a new HA group. (deprecated in favor of HA rules)",
     permissions => {
         check => ['perm', '/', ['Sys.Console']],
     },
@@ -109,6 +115,9 @@ __PACKAGE__->register_method({
     code => sub {
         my ($param) = @_;
 
+        die "cannot create group: ha groups have been migrated to rules\n"
+            if PVE::HA::Config::have_groups_been_migrated();
+
         # create /etc/pve/ha directory
         PVE::Cluster::check_cfs_quorum();
         mkdir("/etc/pve/ha");
@@ -151,7 +160,7 @@ __PACKAGE__->register_method({
     protected => 1,
     path => '{group}',
     method => 'PUT',
-    description => "Update ha group configuration.",
+    description => "Update ha group configuration. (deprecated in favor of HA rules)",
     permissions => {
         check => ['perm', '/', ['Sys.Console']],
     },
@@ -160,6 +169,9 @@ __PACKAGE__->register_method({
     code => sub {
         my ($param) = @_;
 
+        die "cannot update group: ha groups have been migrated to rules\n"
+            if PVE::HA::Config::have_groups_been_migrated();
+
         my $digest = extract_param($param, 'digest');
         my $delete = extract_param($param, 'delete');
 
@@ -216,7 +228,7 @@ __PACKAGE__->register_method({
     protected => 1,
     path => '{group}',
     method => 'DELETE',
-    description => "Delete ha group configuration.",
+    description => "Delete ha group configuration. (deprecated in favor of HA rules)",
     permissions => {
         check => ['perm', '/', ['Sys.Console']],
     },
@@ -233,6 +245,9 @@ __PACKAGE__->register_method({
     code => sub {
         my ($param) = @_;
 
+        die "cannot delete group: ha groups have been migrated to rules\n"
+            if PVE::HA::Config::have_groups_been_migrated();
+
         my $group = extract_param($param, 'group');
 
         PVE::HA::Config::lock_ha_domain(
diff --git a/src/PVE/HA/Config.pm b/src/PVE/HA/Config.pm
index 92d04443..5faa557b 100644
--- a/src/PVE/HA/Config.pm
+++ b/src/PVE/HA/Config.pm
@@ -234,6 +234,15 @@ sub read_group_config {
     return cfs_read_file($ha_groups_config);
 }
 
+sub have_groups_been_migrated {
+    my ($groups) = @_;
+
+    $groups = read_group_config() if !$groups;
+
+    return 1 if !$groups;
+    return keys $groups->{ids}->%* < 1;
+}
+
 sub delete_group_config {
 
     unlink "/etc/pve/$ha_groups_config" or die "failed to remove group config: $!\n";
-- 
2.47.2