glusterFS_native_driver: Access allow or deny of a share to a nova VM should not disrupt IO on existing mounts

[karthick]

Description:

With glusterFS native driver running Kilo, Gluster volume is restarted as part of providing and revoking 'cert' based access in gluster native driver. This disrupts IO to existing mounts. Granting and revoking access should happen more gracefully without any disruption to existing mounts.

Steps to reproduce:

1) Create a manila share from gluster backend
2) allow 'cert' based access to a nova VM
3) Mount the share on the nova VM and run IOs
4) allow 'cert' based access to another nova VM
5) IO on first nova VM will fail

Note: The behavior is same while access is denied as well

Workaround:

rraja: this is a bug in GlusterFS, https://bugzilla.redhat.com/show_bug.cgi?id=1245380 , that allows revocation of TLS based
access only if the volume is restarted, causing disruption to
existing users who have legit access to the share. The patch
for the GlusterFS bug is under review,and fix would be available in glusterfs 3.7.x, which is not yet out. So for Liberty, restart or not restart the volume on deny access based on GlusterFS version. This
would allow the Liberty Manila users to avail the GlusterFS fix once
it's released upstream.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/229409

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/229409
Committed: https://git.openstack.org/cgit/openstack/manila/commit/?id=74cc46c76b5c18481726768edc4a79e9e5a7c706
Submitter: Jenkins
Branch: master

commit 74cc46c76b5c18481726768edc4a79e9e5a7c706
Author: Csaba Henk <email address hidden>
Date: Wed Sep 30 14:57:00 2015 +0200

    glusterfs_native: use dynamic-auth option if available

    With dynamic-auth restarting the volume is not necessary
    in deny_access.

    Change-Id: Ic25af1795c279b34370e25ebdc80c2853a76cc4b
    Closes-bug: #1489081

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/liberty
Review: https://review.openstack.org/229926

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/229926
Committed: https://git.openstack.org/cgit/openstack/manila/commit/?id=77455a5ac6be828e8dfd3e75566eaff2823595d4
Submitter: Jenkins
Branch: stable/liberty

commit 77455a5ac6be828e8dfd3e75566eaff2823595d4
Author: Csaba Henk <email address hidden>
Date: Wed Sep 30 14:57:00 2015 +0200

    glusterfs_native: use dynamic-auth option if available

    With dynamic-auth restarting the volume is not necessary
    in deny_access.

    Change-Id: Ic25af1795c279b34370e25ebdc80c2853a76cc4b
    Closes-bug: #1489081
    (cherry picked from commit 74cc46c76b5c18481726768edc4a79e9e5a7c706)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/235328

[Csaba Henk (chenk)]

The fix is defunct, cf. https://bugs.launchpad.net/manila/+bug/1506577

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/235328
Committed: https://git.openstack.org/cgit/openstack/manila/commit/?id=ec94d6929ea8e1b4ce10dc91cd4954ece808668c
Submitter: Jenkins
Branch: master

commit f1eded1fbcaf309e1c9a4be3f8a14bd25daa3e46
Author: Gaurang Tapase <email address hidden>
Date: Mon Oct 12 20:47:19 2015 +0530

    Fix usage of dependencies

    Manila is broken is threee places, so fix them:
    1) test 'test_misc' with WebOb 1.5

    WebOb 1.5 was released at 2015-10-11. With this new version,
    webob.exc.WSGIHTTPException() constructor now fails with a KeyError
    when the HTTP status code is 0.

    test_exceptions_raise() of test_misc tries to instantiate all
    exceptions of manila.exception. The problem is that
    ConvertedException uses a default HTTP status code of 0.

    Modify the default HTTP status code of ConvertedException to 400 to
    fix the unit tests.

    2) Add dependency for 'testresources' that is required by migration
    tests.

    3) Remove 2 unit tests related to testing of oslo.policy lib
    functionality that should not be tested in Manila. It started failing
    because under-the-hood behaviour was changed in new realese 0.12.0

    Closes-Bug: #1505153
    Closes-Bug: #1505374

    (cherry picked from commit 9c99814ce5943bd4c33bf3650b832666e31b3411)

    -- squashed with another change to get tests to pass on stable/liberty --

    Fix broken unit tests

    With release of six module version 1.10.0 several our unit tests
    started to fail because of usage of not strict constructions.

    Changes:
    1) Manila unit test
    "manila.tests.share.test_api.ShareAPITestCase.test_extend_quota_error"
    used str for int substitution. So, use int data for int substitution.

    2) Module 'manila.share.drivers.hp.hp_3par_mediator' was using
    LOG.exception function when no traceback were exist it led to
    AttributeError on py34. So, replace all usages of 'LOG.exception'
    with 'LOG.error' where no raised exceptions exist.

    Change-Id: Ic5b37bfb9d939d03f6ff68bc53d134bf9e5f996e
    Closes-Bug: #1503969
    (cherry picked from commit f38b8d4efd1f68f4ea29747f7377e0936f61d89c)

    --

    Change-Id: I0f28f3c3fb2c7eec1bafc3a617344990f86810cf

commit 151b691bb2d4baa436913924df60b8c197f91463
Author: Valeriy Ponomaryov <email address hidden>
Date: Thu Oct 1 12:42:05 2015 +0300

    Fix display of availability-zone for manila-manage command

    Commands "manila-manage service list" and "manila-manage host list"
    were displaying availability zone instance instead of its name.

    Such bug appeared after implementation of Availability zone model.
    So, fix it by providing 'name' field of availability zone model.

    Change-Id: I14c3451380df01853183aed265344b1783c95939
    Closes-Bug: #1499677

commit 77455a5ac6be828e8dfd3e75566eaff2823595d4
Author: Csaba Henk <email address hidden>
Date: Wed Sep 30 14:57:00 2015 +0200

    glusterfs_native: use dynamic-auth option if available

    With dynamic-auth restarting the volume is not necessary
    in deny_access.

    Change-Id: Ic25af1795c279b34370...