Cleanup trusted on ejected host

Signed-off-by: Ming Lu <ming.lu@cloud.com>

Author: minglumlu

ocaml/xapi/certificates.ml

@@ -571,3 +571,11 @@ let name_of_uuid uuid = Printf.sprintf "%s.pem" uuid
 
 let db_type_of_category category =
   match category with `Root -> `ca | `Pinned -> `pinned
+
+let cleanup_all_trusted () =
+  let ( let* ) l f = List.iter f l in
+  let* kind = all_trusted_kinds in
+  let* store = trusted_store_locations kind in
+  Unixext.rm_rec ~rm_top:false store.cert_dir ;
+  Unixext.unlink_safe (store.bundle_dir // store.bundle_name) ;
+  ()

ocaml/xapi/certificates.mli

@@ -70,6 +70,8 @@ val sync_all_hosts : __context:Context.t -> API.ref_host list -> unit
 
 val db_type_of_category : [`Root | `Pinned] -> [`ca | `pinned]
 
+val cleanup_all_trusted : unit -> unit
+
 (* Database manipulation *)
 
 module Db_util : sig

ocaml/xapi/xapi_pool.ml

@@ -2385,6 +2385,7 @@ let eject_self ~__context ~host =
     Unixext.unlink_safe Xapi_globs.db_temporary_restore_path ;
     Unixext.unlink_safe Db_globs.ha_metadata_db ;
     Unixext.unlink_safe Db_globs.gen_metadata_db ;
+    Certificates.cleanup_all_trusted () ;
     (* If we've got local storage, remove it *)
     if Helpers.local_storage_exists () then (
       ignore