diff --git a/defaults/main.yml b/defaults/main.yml index 4d3b9aab..942e5ed7 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -18,6 +18,11 @@ cinder_package_state: "latest" cinder_pip_package_state: "latest" +# Set the host which will execute the shade modules +# for the service setup. The host must already have +# clouds.yaml properly configured. +cinder_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}" + # Set installation method. cinder_install_method: "source" @@ -262,11 +267,6 @@ cinder_glance_api_servers: "{{ (glance_service_internalurl | default('http://loc cinder_service_in_ldap: false -# Cinder packages that must be installed before anything else -cinder_requires_pip_packages: - - shade - - virtualenv - # Common pip packages cinder_pip_packages: - cinder diff --git a/meta/main.yml b/meta/main.yml index cf5bbbe7..f4b06470 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -42,4 +42,3 @@ dependencies: when: - ansible_pkg_mgr == 'apt' - galera_client - - openstack_openrc diff --git a/releasenotes/notes/cinder-service-setup-host-712ca5e7b7b9d578.yaml b/releasenotes/notes/cinder-service-setup-host-712ca5e7b7b9d578.yaml new file mode 100644 index 00000000..6670e5b3 --- /dev/null +++ b/releasenotes/notes/cinder-service-setup-host-712ca5e7b7b9d578.yaml @@ -0,0 +1,17 @@ +--- +features: + - | + The service setup in keystone for cinder will now be executed + through delegation to the ``cinder_service_setup_host`` which, + by default, is ``localhost`` (the deploy host). Deployers can + opt to rather change this to the utility container by implementing + the following override in ``user_variables.yml``. + + .. code-block:: yaml + + cinder_service_setup_host: "{{ groups['utility_all'][0] }}" + +deprecations: + - | + The variable ``cinder_requires_pip_packages`` is no longer required + and has therefore been removed. diff --git a/tasks/cinder_backends.yml b/tasks/cinder_backends.yml index 215d14ca..e982b62d 100644 --- a/tasks/cinder_backends.yml +++ b/tasks/cinder_backends.yml @@ -23,6 +23,14 @@ retries: 10 delay: 10 +# TODO(odyssey4me): +# Once these tasks can be replaced by using Ansible modules instead, +# we should do that and use the delegation to the service setup host +# so that we can remove the openrc file from the target host. +- name: Implement openrc/clouds.yaml + include_role: + name: "openstack_openrc" + - name: Create singular cinder_backends variable for all hosts set_fact: _cinder_backends: "{{ (_cinder_backends | default(cinder_backends | default({}))) | combine(hostvars[item]['cinder_backends'] | default({})) }}" diff --git a/tasks/cinder_install_source.yml b/tasks/cinder_install_source.yml index b38d135a..f232b048 100644 --- a/tasks/cinder_install_source.yml +++ b/tasks/cinder_install_source.yml @@ -22,19 +22,6 @@ {% endfor %} when: cinder_developer_mode | bool -- name: Install requires pip packages - pip: - name: "{{ cinder_requires_pip_packages }}" - state: "{{ cinder_pip_package_state }}" - extra_args: >- - {{ cinder_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }} - {{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }} - {{ pip_install_options | default('') }} - register: install_packages - until: install_packages|success - retries: 5 - delay: 2 - - name: Retrieve checksum for venv download uri: url: "{{ cinder_venv_download_url | replace('tgz', 'checksum') }}" diff --git a/tasks/cinder_service_setup.yml b/tasks/cinder_service_setup.yml index e1afbe09..1c0cb087 100644 --- a/tasks/cinder_service_setup.yml +++ b/tasks/cinder_service_setup.yml @@ -13,114 +13,112 @@ # See the License for the specific language governing permissions and # limitations under the License. -# Create an admin user -- name: Ensure cinder user - keystone: - command: "ensure_user" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - user_name: "{{ cinder_service_user_name }}" - tenant_name: "{{ cinder_service_project_name }}" - password: "{{ cinder_service_password }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - when: not cinder_service_in_ldap | bool - until: add_service|success - retries: 5 - delay: 10 - no_log: True +# We set the python interpreter to the ansible runtime venv if +# the delegation is to localhost so that we get access to the +# appropriate python libraries in that venv. If the delegation +# is to another host, we assume that it is accessible by the +# system python instead. +- name: Setup the service + delegate_to: "{{ cinder_service_setup_host }}" + vars: + ansible_python_interpreter: >- + {{ (cinder_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_python['executable']) }} + block: + - name: Add services to the keystone service catalog + os_keystone_service: + cloud: default + state: "{{ item.state }}" + name: "{{ item.name }}" + service_type: "{{ item.service_type }}" + description: "{{ item.description }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + until: add_service is success + retries: 5 + delay: 10 + with_items: + - name: "{{ cinder_service_name }}" + service_type: "{{ cinder_service_type }}" + description: "{{ cinder_service_description }}" + state: absent + - name: "{{ cinder_service_v2_name }}" + service_type: "{{ cinder_service_v2_type }}" + description: "{{ cinder_service_v2_description }}" + state: "{{ (cinder_enable_v2_api | bool) | ternary('present', 'absent') }}" + - name: "{{ cinder_service_v3_name }}" + service_type: "{{ cinder_service_v3_type }}" + description: "{{ cinder_service_v3_description }}" + state: present -# Add a role to the user -- name: Ensure cinder user to admin role - keystone: - command: "ensure_user_role" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - user_name: "{{ cinder_service_user_name }}" - tenant_name: "{{ cinder_service_project_name }}" - role_name: "{{ cinder_service_role_name }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - when: not cinder_service_in_ldap | bool - until: add_service|success - retries: 5 - delay: 10 - no_log: True + - name: Add service user + os_user: + cloud: default + state: present + name: "{{ cinder_service_user_name }}" + password: "{{ cinder_service_password }}" + domain: default + default_project: "{{ cinder_service_project_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + when: not cinder_service_in_ldap | bool + until: add_service is success + retries: 5 + delay: 10 + no_log: True -# Create a service -- name: Ensure cinder service - os_keystone_service: - auth: - auth_url: "{{ keystone_service_adminurl }}" - username: "{{ cinder_service_user_name }}" - password: "{{ cinder_service_password }}" - project_name: "{{ cinder_service_project_name }}" - user_domain_name: "{{ cinder_service_user_domain_id }}" - project_domain_name: "{{ cinder_service_project_domain_id }}" - endpoint_type: admin - region_name: "{{ cinder_service_region }}" - validate_certs: "{{ keystone_service_adminuri_insecure | ternary(false, true) }}" - name: "{{ item.name }}" - service_type: "{{ item.type }}" - description: "{{ item.description }}" - state: "{{ item.state }}" - register: add_service - until: add_service|success - retries: 5 - delay: 10 - with_items: - - name: "{{ cinder_service_name }}" - type: "{{ cinder_service_type }}" - description: "{{ cinder_service_description }}" - state: absent - - name: "{{ cinder_service_v2_name }}" - type: "{{ cinder_service_v2_type }}" - description: "{{ cinder_service_v2_description }}" - state: "{{ cinder_enable_v2_api | bool | ternary('present', 'absent') }}" - - name: "{{ cinder_service_v3_name }}" - type: "{{ cinder_service_v3_type }}" - description: "{{ cinder_service_v3_description }}" - state: present - no_log: True + - name: Add service user to admin role + os_user_role: + cloud: default + state: present + user: "{{ cinder_service_user_name }}" + role: "{{ cinder_service_role_name }}" + project: "{{ cinder_service_project_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + when: not cinder_service_in_ldap | bool + until: add_service is success + retries: 5 + delay: 10 -# Create an endpoint -- name: Ensure cinder endpoint - keystone: - command: "ensure_endpoint" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - region_name: "{{ cinder_service_region }}" - service_name: "{{ item.name }}" - service_type: "{{ item.type }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - endpoint_list: - - url: "{{ item.publicurl }}" - interface: "public" - - url: "{{ item.internalurl }}" - interface: "internal" - - url: "{{ item.adminurl }}" - interface: "admin" - when: item.condition | default(true) - register: add_service - until: add_service|success - retries: 5 - delay: 10 - with_items: - - name: "{{ cinder_service_v2_name }}" - type: "{{ cinder_service_v2_type }}" - publicurl: "{{ cinder_service_v2_publicurl }}" - internalurl: "{{ cinder_service_v2_internalurl }}" - adminurl: "{{ cinder_service_v2_adminurl }}" - condition: "{{ cinder_enable_v2_api | bool }}" - - name: "{{ cinder_service_v3_name }}" - type: "{{ cinder_service_v3_type }}" - publicurl: "{{ cinder_service_v3_publicurl }}" - internalurl: "{{ cinder_service_v3_internalurl }}" - adminurl: "{{ cinder_service_v3_adminurl }}" - no_log: True + - name: Add endpoints to keystone endpoint catalog + os_keystone_endpoint: + cloud: default + state: "{{ item.state }}" + service: "{{ item.service }}" + endpoint_interface: "{{ item.interface }}" + url: "{{ item.url }}" + region: "{{ cinder_service_region }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + until: add_service is success + retries: 5 + delay: 10 + with_items: + - service: "{{ cinder_service_v2_name }}" + interface: "public" + url: "{{ cinder_service_v2_publicurl }}" + state: "{{ (cinder_enable_v2_api | bool) | ternary('present', 'absent') }}" + - service: "{{ cinder_service_v2_name }}" + interface: "internal" + url: "{{ cinder_service_v2_internalurl }}" + state: "{{ (cinder_enable_v2_api | bool) | ternary('present', 'absent') }}" + - service: "{{ cinder_service_v2_name }}" + interface: "admin" + url: "{{ cinder_service_v2_adminurl }}" + state: "{{ (cinder_enable_v2_api | bool) | ternary('present', 'absent') }}" + - service: "{{ cinder_service_v3_name }}" + interface: "public" + url: "{{ cinder_service_v3_publicurl }}" + state: present + - service: "{{ cinder_service_v3_name }}" + interface: "internal" + url: "{{ cinder_service_v3_internalurl }}" + state: present + - service: "{{ cinder_service_v3_name }}" + interface: "admin" + url: "{{ cinder_service_v3_adminurl }}" + state: present diff --git a/tests/host_vars/localhost.yml b/tests/host_vars/localhost.yml index 787f6cbc..acc472f0 100644 --- a/tests/host_vars/localhost.yml +++ b/tests/host_vars/localhost.yml @@ -16,4 +16,3 @@ bridges: - name: "br-mgmt" ip_addr: "10.1.1.1" -ansible_python_interpreter: "/usr/bin/python2"