Add semantic checks to protect host capabilities

[Daniel Badea]

protect host capabilities

Brief Description
-----------------
There is no semantic check to prevent updating of host capabilities from CLI. For example:

  system host-update storage-1 capabilities="{'stor_function':'monitor'}"

runs successfully when it shouldn't (storage-1 is not/should not run a ceph monitor service).

Severity
--------
Major

Steps to Reproduce
------------------
system host-update storage-1 capabilities="{'stor_function':'monitor'}"

Expected Behavior
------------------
"system host-update" command should fail when trying to update capabilities that are used by other services

Actual Behavior
----------------
Host capabilities are updated

Reproducibility
---------------
Reproducible

System Configuration
--------------------
Discovered on a storage system but can be reproduced on any type of system by setting 'Personality' for a controller node.

Branch/Pull Time/Commit
-----------------------
stx/master

Timestamp/Logs
--------------
N/A

[Ghada Khalil (gkhalil)]

Targeting stx.2019.03 as this just adds semantic checks for extra protection

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/605124

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/605124
Committed: https://git.openstack.org/cgit/openstack/stx-config/commit/?id=9231c6765a0b2953314b61d0ecca3fe17d671e31
Submitter: Zuul
Branch: master

commit 9231c6765a0b2953314b61d0ecca3fe17d671e31
Author: Daniel Badea <email address hidden>
Date: Tue Sep 25 16:09:52 2018 +0000

    protect host capabilities

    Reject updating read-only host capabilities:
    1. stor_function. This field is set to 'monitor' for hosts
       that are running ceph monitor process: controller-0,
       controller-1, storage-0.
    2. Personality. This field is "virtual": not saved in the
       database but returned via API and displayed via
       "system host-show".

    Change-Id: I6d169b68bffd74e7fae56f9d92d5930593cefe59
    Closes-Bug: #1794117
    Signed-off-by: Daniel Badea <email address hidden>