fix instance exclusion system

It seems like the `htools:iextags:FOO` parameter is a PREFIX. So the
previous system didn't actually work, because (e.g.) no web-fsn:* tag
existed.

I have fixed the actual cluster to use service:* tags.

howto/ganeti.md

@@ -739,9 +739,9 @@ The way to ensure they get distributed properly by the balancing
 algorithm is to "tag" them. For the web nodes, for example, this was
 performed on the master:
 
-    gnt-instance add-tags web-fsn-01.torproject.org web-fsn
-    gnt-instance add-tags web-fsn-02.torproject.org web-fsn
-    gnt-cluster add-tags htools:iextags:web-fsn
+    gnt-cluster add-tags htools:iextags:service
+    gnt-instance add-tags web-fsn-01.torproject.org service:web-fsn
+    gnt-instance add-tags web-fsn-02.torproject.org service:web-fsn
 
 This tells Ganeti that `web-fsn` is an "exclusion tag" and the
 optimizer will not try to schedule instances with those tags on the
@@ -750,14 +750,21 @@ same node.
 To see which tags are present, use:
 
     # gnt-cluster list-tags
-    htools:iextags:web-fsn
+    htools:iextags:service
 
 You can also find which nodes are assigned to a tag with:
 
-    # gnt-cluster search-tags web-fsn
-    /cluster htools:iextags:web-fsn
-    /instances/web-fsn-01.torproject.org web-fsn
-    /instances/web-fsn-02.torproject.org web-fsn
+    # gnt-cluster search-tags service
+    /cluster htools:iextags:service
+    /instances/web-fsn-01.torproject.org service:web-fsn
+    /instances/web-fsn-02.torproject.org service:web-fsn
+
+IMPORTANT: a previous version of this article mistakenly indicated
+that a new cluster-level tag had to be created for each service. That
+method did *not* work. The [hbal manpage](http://docs.ganeti.org/ganeti/current/man/hbal.html#exclusion-tags) explicitely mentions that
+the cluster-level tag is a *prefix* that can be used to create
+*multiple* such tags. This configuration also happens to be simpler
+and easier to use...
 
 ## Adding and removing addresses on instances