EntityOwnershipService does not specify what it provides mutual exclusion over

The current EntityOwnershipService API simply provides getOwnershipState(), but doesn't provide a notion of how long that state will be valid for or to only take certain actions assuming the ownership state is a certain value.

This makes using the EntityOwnershipService for applications somewhat complex. The high-level behavior I think applications are looking for from EntityOwnershipService is mutual exclusion, that is that only one instance of OpenDaylight will be the owner at any given point in time.

The problem is that that with the RAFT (or really any other distributed system) backing of the EntityOwnershipService doesn't provide a single view of the ownership state at a given point in wall-clock time, but only in terms of logical time (that is transactions on the shard keeping ownership state date).

The result is that it is entirely possible for two different instances of OpenDaylight to be at different logical times and both believe that they are the owner for a given entity at the same wall-clock time. As a concrete example:

• Assume we have 3 instances, A, B, and C
• Assume A starts as the owner for entity X
• At some point, B tries to become the owner for X
• When B writes it, we get a quorum from B and C, so A still doesn't know about the change
• From when B hears that transaction committed until A hears about it, both A and B believe they are the owner for X

To solve this, you need some way for applications to say, "Assuming I am still the owner of X, please do the following things." This is effectively an atomic test-and-set: https://en.wikipedia.org/wiki/Test-and-set