Require managed-containerd protocol v1

ocf/loxthelion/managed-container.d/proxy.sh

@@ -146,7 +146,10 @@ path, resource = sys.argv[1], sys.argv[2]
 TRANSPORT_FAILURE = int(sys.argv[3])
 PROTOCOL_FAILURE = int(sys.argv[4])
 
+PROTOCOL_VERSION = 1
+
 request = {
+    "protocol_version": PROTOCOL_VERSION,
     "action": "monitor",
     "resource": resource,
 }
@@ -189,9 +192,20 @@ except (UnicodeDecodeError, json.JSONDecodeError):
 if not isinstance(obj, dict):
     raise SystemExit(PROTOCOL_FAILURE)
 
+# The daemon is reachable at this point, so any protocol mismatch is a hard
+# control-plane failure. It must never be hidden by cached application health.
+if obj.get("protocol_version") != PROTOCOL_VERSION:
+    raise SystemExit(PROTOCOL_FAILURE)
+
 if not obj.get("ok"):
     raise SystemExit(PROTOCOL_FAILURE)
 
+if obj.get("resource") != resource:
+    raise SystemExit(PROTOCOL_FAILURE)
+
+if obj.get("action") != "monitor":
+    raise SystemExit(PROTOCOL_FAILURE)
+
 result = obj.get("result")
 if not isinstance(result, dict):
     raise SystemExit(PROTOCOL_FAILURE)