Disable the nova-consoleauth service on HA.

When using the nova-cloud-controller charm in HA with the config
option single-nova-consoleauth set to true, its expected for the
nova-consoleauth service to be run in just a single unit at the time.

The service management (start/stop) is performed by pacemaker in
accordance with the cluster health using the OCF resource agent[0].

Its required for the service to be disabled by default on upstart (trusty)
or systemd (>=xenial).

This change disables the service by using the service_pause
charmhelpers call which considers both cases (upstart/systemd) when
the ha relation is present and the single-nova-consoleauth option is
used.

Also, this change fixes LP: #1660244 (Services not running that should be:
nova-consoleauth) by removing it from the resource_map when
ha + single-nova-consoleauth is used.

[0] https://github.com/openstack/openstack-resource-agents/blob/master/ocf/nova-consoleauth

Closes-Bug: #1693629
Closes-Bug: #1660244

Change-Id: Iaffe0456cceb42ee124cb8881d3379d78cac0f3a
Signed-off-by: Jorge Niedbalski <jorge.niedbalski@canonical.com>

hooks/nova_cc_hooks.py

@@ -47,6 +47,7 @@ from charmhelpers.core.hookenv import (
 
 from charmhelpers.core.host import (
     service_reload,
+    service_pause,
 )
 
 from charmhelpers.fetch import (
@@ -1153,11 +1154,10 @@ def update_nova_consoleauth_config():
         for rid in relation_ids('ha'):
             relation_set(rid, **data)
 
-        # nova-consoleauth will be managed by pacemaker, so mark it as manual
+        # nova-consoleauth will be managed by pacemaker, so stop it
+        # and prevent it to be started again at boot. (LP: #1693629).
         if relation_ids('ha'):
-            with open(NOVA_CONSOLEAUTH_OVERRIDE, 'w') as fp:
-                fp.write('manual\n')
-                fp.flush()
+            service_pause('nova-consoleauth')
 
     elif (not config('single-nova-consoleauth') and
           console_attributes('protocol')):

hooks/nova_cc_utils.py

@@ -353,6 +353,13 @@ def resource_map(actual_services=True):
 
     if console_attributes('services'):
         resource_map[NOVA_CONF]['services'] += console_attributes('services')
+        # nova-consoleauth will be managed by pacemaker, if
+        # single-nova-consoleauth is used, then don't monitor for the
+        # nova-consoleauth service to be started (LP: #1660244).
+        if config('single-nova-consoleauth') and relation_ids('ha'):
+            services = resource_map[NOVA_CONF]['services']
+            if 'nova-consoleauth' in services:
+                services.remove('nova-consoleauth')
 
     if (config('enable-serial-console') and cmp_os_release >= 'juno'):
         resource_map[NOVA_CONF]['services'] += SERIAL_CONSOLE['services']

unit_tests/test_nova_cc_hooks.py

@@ -1027,7 +1027,7 @@ class NovaCCHooksTests(CharmTestCase):
 
     @patch.object(hooks, 'is_db_initialised')
     @patch.object(hooks, 'determine_packages')
-    @patch.object(utils, 'service_pause')
+    @patch.object(hooks, 'service_pause')
     @patch.object(hooks, 'filter_installed_packages')
     @patch('nova_cc_hooks.configure_https')
     @patch('nova_cc_utils.config')
@@ -1042,7 +1042,13 @@ class NovaCCHooksTests(CharmTestCase):
         self.config_value_changed.return_value = False
         self.git_install_requested.return_value = False
         self.os_release.return_value = 'diablo'
-        config.return_value = 'novnc'
+
+        def cfg(k, v):
+            if k == "single-nova-authconsole":
+                return True
+            return 'novnc'
+
+        config.side_effect = cfg
         rids = {'ha': ['ha:1']}
 
         def f(r):
@@ -1065,6 +1071,9 @@ class NovaCCHooksTests(CharmTestCase):
             call(v, **args) for v in rids['ha']
         ])
 
+        mock_service_pause.assert_has_calls([
+            call('nova-consoleauth')]
+        )
         mock_filter_packages.assert_called_with([])
 
     @patch.object(hooks, 'is_api_ready')

unit_tests/test_nova_cc_utils.py

@@ -267,6 +267,16 @@ class NovaCCUtilsTests(CharmTestCase):
         for service in console_services:
             self.assertIn(service, _map['/etc/nova/nova.conf']['services'])
 
+    @patch('charmhelpers.contrib.openstack.context.SubordinateConfigContext')
+    def test_resource_map_single_nova_consoleauth(self, subcontext):
+        self.test_config.set('console-access-protocol', 'spice')
+        self.test_config.set('single-nova-consoleauth', True)
+        self.os_release.return_value = 'ocata'
+        self.relation_ids.return_value = ['ha']
+        _map = utils.resource_map()
+        self.assertNotIn('nova-consoleauth',
+                         _map['/etc/nova/nova.conf']['services'])
+
     @patch('charmhelpers.contrib.openstack.neutron.os_release')
     @patch('os.path.exists')
     @patch('charmhelpers.contrib.openstack.context.SubordinateConfigContext')