Description of problem:
This has been partially implemented in bz1404233 - the "pcs cluster cib-push" command has now an option to obtain and push just a diff instead of the whole CIB.

It is required to make this approach a standard way of pushing cib in all pcs commands. The only exception is the "pcs cluster cib-push" command where the user may want to really overwrite the existing CIB and make the live CIB look exactly like what has been provided to the command.

Reasoning:
1) avoid conflicts when editing the CIB simultaneously
See bz1404233 for more details.

2) replacing the whole CIB fails when ACLs are in place, see reproducer

3) performance reasons
When pushing the whole CIB, it takes more time to process it in pacemaker.


Version-Release number of selected component (if applicable):
pcs-0.9.157-1.el7.x86_64


How reproducible:
always, easily


Steps to Reproduce:
[root@rh73-node1:~]# pcs resource create dummy1 ocf:pacemaker:Dummy    
[root@rh73-node1:~]# pcs resource create dummy2 ocf:pacemaker:Dummy
[root@rh73-node1:~]# pcs acl user create user1
[root@rh73-node1:~]# pcs acl role create role1
[root@rh73-node1:~]# pcs acl permission add role1 write xpath /
[root@rh73-node1:~]# pcs acl permission add role1 write xpath /cib/configuration
[root@rh73-node1:~]# pcs acl permission add role1 deny id dummy1
# avoid bz1441669
[root@rh73-node1:~]# pcs acl permission add role1 deny xpath /cib/configuration/acls
[root@rh73-node1:~]# pcs acl role assign role1 user user1
[root@rh73-node1:~]# pcs acl enable

# now switch to user1
[user1@rh73-node1 ~]$ pcs resource disable dummy2
Error: Unable to update cib
Call cib_replace failed (-13): Permission denied


Actual results:
It is not possible to edit the CIB.


Expected results:
It is possible to edit CIB.


Additional info:
The command fails, because:
* When reading the CIB, dummy1 resource is filtered out because of the configured ACLs.
* Dummy2 resource is updated in memory.
* The whole CIB is pushed, but it does not contain dummy1 resource - see above.
* Pacemaker evaluates this as an attempt to remove dummy1 resource, which is prohibited by the ACLs.

If only a diff is pushed, everything works, as the diff does not contain any changes to dummy1 resource.