Execute service setup against a delegated host using Ansible built-in modules

In order to reduce the packages required to pip install on to the hosts,
we allow the service setup to be delegated to a specific host, defaulting
to the deploy host. We also switch as many tasks as possible to using the
built-in Ansible modules which make use of the shade library.

The 'virtualenv' package is now installed appropriately by the openstack_hosts
role, so there's no need to install it any more. The 'httplib2' package is a
legacy Ansible requirement for the get_url/get_uri module which is no longer
needed. As there are no required packages left, the task to install them is
also removed.

With the dependent patches, the openstack_openrc role is now executed once
on the designated host, so it is no longer required as a meta-dependency for
the role.

Ansible 2.5 is a hard dependency for this patch due to the dynamic setting
of the ansible_python_interpreter, which in 2.4 is literally interpreted,
but in 2.5 thanks to [1] is now templated. See [2] for more details.

[1] https://github.com/ansible/ansible/pull/33698
[2] https://github.com/ansible/ansible/issues/18665
Depends-On: https://review.openstack.org/501814
Depends-On: https://review.openstack.org/568139
Depends-On: https://review.openstack.org/568141
Depends-On: https://review.openstack.org/568146
Depends-On: https://review.openstack.org/571423
Depends-On: https://review.openstack.org/579233
Depends-On: https://review.openstack.org/579959
Depends-On: https://review.openstack.org/580156
Change-Id: I6a5a85fae5a481900149a343a163fe82e788d1eb

defaults/main.yml

@@ -19,6 +19,11 @@ debug: False
 # Set installation method
 glance_install_method: "source"
 
+# Set the host which will execute the shade modules
+# for the service setup. The host must already have
+# clouds.yaml properly configured.
+glance_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}"
+
 # Set the package install state for distribution and pip packages
 # Options are 'present' and 'latest'
 glance_package_state: "latest"
@@ -225,12 +230,6 @@ glance_rbd_store_chunk_size: 8
 
 glance_service_in_ldap: false
 
-
-# Cinder packages that must be installed before anything else
-glance_requires_pip_packages:
-  - virtualenv
-  - httplib2
-
 # Common pip packages
 glance_pip_packages:
   - cryptography

meta/main.yml

@@ -42,4 +42,3 @@ dependencies:
     when:
       - ansible_pkg_mgr == 'apt'
   - galera_client
-  - openstack_openrc

releasenotes/notes/glance-service-setup-host-b0e71be408de074b.yaml

@@ -0,0 +1,17 @@
+---
+features:
+  - |
+    The service setup in keystone for glance will now be executed
+    through delegation to the ``glance_service_setup_host`` which,
+    by default, is ``localhost`` (the deploy host). Deployers can
+    opt to rather change this to the utility container by implementing
+    the following override in ``user_variables.yml``.
+
+    .. code-block:: yaml
+
+      glance_service_setup_host: "{{ groups['utility_all'][0] }}"
+
+deprecations:
+  - |
+    The variable ``glance_requires_pip_packages`` is no longer required
+    and has therefore been removed.

tasks/glance_install_source.yml

@@ -22,19 +22,6 @@
       {% endfor %}
   when: glance_developer_mode | bool
 
-- name: Install requires pip packages
-  pip:
-    name: "{{ glance_requires_pip_packages }}"
-    state: "{{ glance_pip_package_state }}"
-    extra_args: >-
-      {{ glance_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }}
-      {{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }}
-      {{ pip_install_options | default('') }}
-  register: install_packages
-  until: install_packages|success
-  retries: 5
-  delay: 2
-
 - name: Retrieve checksum for venv download
   uri:
     url: "{{ glance_venv_download_url | replace('tgz', 'checksum') }}"

tasks/glance_service_setup.yml

@@ -13,83 +13,81 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Create a service
-- name: Ensure glance service
-  keystone:
-    command: "ensure_service"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    service_name: "{{ glance_service_name }}"
-    service_type: "{{ glance_service_type }}"
-    description: "{{ glance_service_description }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-  register: add_service
-  until: add_service|success
-  retries: 5
-  delay: 2
-  no_log: True
+# We set the python interpreter to the ansible runtime venv if
+# the delegation is to localhost so that we get access to the
+# appropriate python libraries in that venv. If the delegation
+# is to another host, we assume that it is accessible by the
+# system python instead.
+- name: Setup the service
+  delegate_to: "{{ glance_service_setup_host }}"
+  vars:
+    ansible_python_interpreter: >-
+      {{ (glance_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_python['executable']) }}
+  block:
+    - name: Add service to the keystone service catalog
+      os_keystone_service:
+        cloud: default
+        state: present
+        name: "{{ glance_service_name }}"
+        service_type: "{{ glance_service_type }}"
+        description: "{{ glance_service_description }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service
+      until: add_service is success
+      retries: 5
+      delay: 10
 
-# Create an admin user
-- name: Ensure glance user
-  keystone:
-    command: "ensure_user"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    user_name: "{{ glance_service_user_name }}"
-    tenant_name: "{{ glance_service_project_name }}"
-    password: "{{ glance_service_password }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-  register: add_service
-  when: not glance_service_in_ldap | bool
-  until: add_service|success
-  retries: 5
-  delay: 10
-  no_log: True
+    - name: Add service user
+      os_user:
+        cloud: default
+        state: present
+        name: "{{ glance_service_user_name }}"
+        password: "{{ glance_service_password }}"
+        domain: default
+        default_project: "{{ glance_service_project_name }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service
+      when: not glance_service_in_ldap | bool
+      until: add_service is success
+      retries: 5
+      delay: 10
+      no_log: True
 
-# Add a role to the user
-- name: Ensure glance user to admin role
-  keystone:
-    command: "ensure_user_role"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    user_name: "{{ glance_service_user_name }}"
-    tenant_name: "{{ glance_service_project_name }}"
-    role_name: "{{ glance_role_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-  register: add_service
-  when: not glance_service_in_ldap | bool
-  until: add_service|success
-  retries: 5
-  delay: 10
-  no_log: True
+    - name: Add service user to admin role
+      os_user_role:
+        cloud: default
+        state: present
+        user: "{{ glance_service_user_name }}"
+        role: "{{ glance_role_name }}"
+        project: "{{ glance_service_project_name }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service
+      when: not glance_service_in_ldap | bool
+      until: add_service is success
+      retries: 5
+      delay: 10
 
-# Create an endpoint
-- name: Ensure glance endpoint
-  keystone:
-    command: "ensure_endpoint"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    region_name: "{{ glance_service_region }}"
-    service_name: "{{ glance_service_name }}"
-    service_type: "{{ glance_service_type }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-    endpoint_list:
-      - url: "{{ glance_service_publicurl }}"
-        interface: "public"
-      - url: "{{ glance_service_internalurl }}"
-        interface: "internal"
-      - url: "{{ glance_service_adminurl }}"
-        interface: "admin"
-  register: add_service
-  until: add_service|success
-  retries: 5
-  delay: 10
-  no_log: True
+    - name: Add endpoints to keystone endpoint catalog
+      os_keystone_endpoint:
+        cloud: default
+        state: present
+        service: "{{ glance_service_name }}"
+        endpoint_interface: "{{ item.interface }}"
+        url: "{{ item.url }}"
+        region: "{{ glance_service_region }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service
+      until: add_service is success
+      retries: 5
+      delay: 10
+      with_items:
+        - interface: "public"
+          url: "{{ glance_service_publicurl }}"
+        - interface: "internal"
+          url: "{{ glance_service_internalurl }}"
+        - interface: "admin"
+          url: "{{ glance_service_adminurl }}"

tests/host_vars/localhost.yml

@@ -16,5 +16,3 @@
 bridges:
   - name: "br-mgmt"
     ip_addr: "10.1.0.1"
-
-ansible_python_interpreter: "/usr/bin/python2"