vrrp: T6020: vrrp health-check script not applied correctly in keepalived.conf

Added health-check to sync-group in CLI
Don't use instance health-check when instance in sync group member
Disallow wrong healtch-check configurations
New smoke test

1 files changed, 27 insertions, 10 deletions

diff --git a/src/conf_mode/high-availability.py b/src/conf_mode/high-availability.py
index 59d49ea67..c726db8b2 100755
--- a/src/conf_mode/high-availability.py
+++ b/src/conf_mode/high-availability.py
@@ -86,16 +86,7 @@ def verify(ha):
                     raise ConfigError(f'Authentication requires both type and passwortd to be set in VRRP group "{group}"')
 
             if 'health_check' in group_config:
-                health_check_types = ["script", "ping"]
-                from vyos.utils.dict import check_mutually_exclusive_options
-                try:
-                    check_mutually_exclusive_options(group_config["health_check"], health_check_types, required=True)
-                except ValueError:
-                    Warning(f'Health check configuration for VRRP group "{group}" will remain unused ' \
-                            f'until it has one of the following options: {health_check_types}')
-                    # XXX: health check has default options so we need to remove it
-                    # to avoid generating useless config statements in keepalived.conf
-                    del group_config["health_check"]
+                _validate_health_check(group, group_config)
 
             # Keepalived doesn't allow mixing IPv4 and IPv6 in one group, so we mirror that restriction
             # We also need to make sure VRID is not used twice on the same interface with the
@@ -146,11 +137,22 @@ def verify(ha):
     # Check sync groups
     if 'vrrp' in ha and 'sync_group' in ha['vrrp']:
         for sync_group, sync_config in ha['vrrp']['sync_group'].items():
+            if 'health_check' in sync_config:
+                _validate_health_check(sync_group, sync_config)
+
             if 'member' in sync_config:
                 for member in sync_config['member']:
                     if member not in ha['vrrp']['group']:
                         raise ConfigError(f'VRRP sync-group "{sync_group}" refers to VRRP group "{member}", '\
                                           'but it does not exist!')
+                    else:
+                        ha['vrrp']['group'][member]['_is_sync_group_member'] = True
+                        if ha['vrrp']['group'][member].get('health_check') is not None:
+                            raise ConfigError(
+                                f'Health check configuration for VRRP group "{member}" will remain unused '
+                                f'while it has member of sync group "{sync_group}" '
+                                f'Only sync group health check will be used'
+                            )
 
     # Virtual-server
     if 'virtual_server' in ha:
@@ -172,6 +174,21 @@ def verify(ha):
                 raise ConfigError(f'Port is required but not set for virtual-server "{vs}" real-server "{rs}"')
 
 
+def _validate_health_check(group, group_config):
+    health_check_types = ["script", "ping"]
+    from vyos.utils.dict import check_mutually_exclusive_options
+    try:
+        check_mutually_exclusive_options(group_config["health_check"],
+                                         health_check_types, required=True)
+    except ValueError:
+        Warning(
+            f'Health check configuration for VRRP group "{group}" will remain unused ' \
+            f'until it has one of the following options: {health_check_types}')
+        # XXX: health check has default options so we need to remove it
+        # to avoid generating useless config statements in keepalived.conf
+        del group_config["health_check"]
+
+
 def generate(ha):
     if not ha or 'disable' in ha:
         if os.path.isfile(systemd_override):