CP-309847: Make HTTP/80 configurable

[liulinC]

• Introduce https_only argument for Host.create
• Set https_only from configuration for installation
• Keep https_only from joining host during pool join

[liulinC]

The configuration file is added in the spec repo.

[edwintorok]

don't we already have an option like this?

[edwintorok]

It has been introduced in XAPI 22.27.0

[edwintorok]

Hmm there is some duplication between create_params and the fields, looks like this was missing from create_params before.

It'd be good if the list of fields in create_params wouldn't have to be repeated when creating the object itself, otherwise we have to declare some fields twice, as here.

[liulinC]

Doesn't they means two different things? One is DB field, and one is API argument?
I presume not all field needs to be exposed during create API?

[robhoes]

The host.create API call does not include all fields indeed. It is not a public call and only used by xapi internally, for pool join.

[lindig]

What is the connection with

let set_https_only =
  call ~name:"set_https_only"
    ~doc:
      "updates the host firewall to open or close port 80 depending on the \
       value"
    ~lifecycle:[]
    ~params:
      [
        (Ref _host, "self", "The Host")
      ; ( Bool
        , "value"
        , "true - http port 80 will be blocked, false - http port 80 will be \
           open"
        )
      ]
    ~allowed_roles:_R_POOL_OP ()

This appears to serve the same purpose and this field will have a default. So why is it not enough to change the default? I looked at the ticket and it is not obvious. Also, if this is a policy, should this not be tied to the pool?

[robhoes]

What is the connection with (...)

That is an API call to change firewall. This PR is about making the installation default configurable (not obvious from the PR title "Make HTTP/80 configurable"). It also preserves the configuration on pool join.

[lindig]

What is the problem being solved by this PR compared to the existing solution and could it not be extended? Is the difference not rather small and thus risks confusion?

[liulinC]

What is the problem being solved by this PR compared to the existing solution and could it not be extended? Is the difference not rather small and thus risks confusion?

The background here is we want to disable(not expose) http on XS9 while keep it open for XS8 by default.
So what really matters is the default value.
Of-course, user can use set_https_only to set it another value if they want, but what we update here is the default value without the later explicit settings.

Another way is we use some first boot service to set the value after xapi startup with set_https_only, which is not as clean as current solution.

[lindig]

Another way is we use some first boot service to set the value after xapi startup with set_https_only, which is not as clean as current solution.

This changes 8 files whereas that would re-use an existing mechanism. Anyway, thanks for providing some background.

[liulinC]

push -f just update the release version number.

[changlei-li]

When host joins pool, the host will use pool master's https_only value, am I right?

[changlei-li]

strange blank line

[liulinC]

I added a line of code here and then remove it, which cause this empty line.
make format does not care about this.

[liulinC]

When host joins pool, the host will use pool master's https_only value, am I right?

Before joining the pool, the check would make sure the https_only field is the same with pool master,
here we use the local host value, (which is the same as master)