Execute service setup against a delegated host using Ansible built-in modules

In order to reduce the packages required to pip install on to the hosts,
we allow the service setup to be delegated to a specific host, defaulting
to the deploy host. We also switch as many tasks as possible to using the
built-in Ansible modules which make use of the shade library.

The 'virtualenv' package is now installed appropriately by the openstack_hosts
role, so there's no need to install it any more. The 'httplib2' package is a
legacy Ansible requirement for the get_url/get_uri module which is no longer
needed. As there are no required packages left, the task to install them is
also removed.

With the dependent patches, the openstack_openrc role is now executed once
on the designated host, so it is no longer required as a meta-dependency for
the role.

Ansible 2.5 is a hard dependency for this patch due to the dynamic setting
of the ansible_python_interpreter, which in 2.4 is literally interpreted,
but in 2.5 thanks to [1] is now templated. See [2] for more details.

[1] https://github.com/ansible/ansible/pull/33698
[2] https://github.com/ansible/ansible/issues/18665
Depends-On: https://review.openstack.org/501814
Depends-On: https://review.openstack.org/568139
Depends-On: https://review.openstack.org/568141
Depends-On: https://review.openstack.org/568146
Depends-On: https://review.openstack.org/571423
Depends-On: https://review.openstack.org/579233
Depends-On: https://review.openstack.org/579959
Depends-On: https://review.openstack.org/580156
Change-Id: I6a5a85fae5a481900149a343a163fe82e788d1eb
This commit is contained in:
Jesse Pretorius 2018-05-13 20:31:47 +01:00 committed by Jesse Pretorius (odyssey4me)
parent 3b901cf57f
commit fa11f38215
6 changed files with 97 additions and 99 deletions

View File

@ -19,6 +19,11 @@ debug: False
# Set installation method # Set installation method
glance_install_method: "source" glance_install_method: "source"
# Set the host which will execute the shade modules
# for the service setup. The host must already have
# clouds.yaml properly configured.
glance_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}"
# Set the package install state for distribution and pip packages # Set the package install state for distribution and pip packages
# Options are 'present' and 'latest' # Options are 'present' and 'latest'
glance_package_state: "latest" glance_package_state: "latest"
@ -225,12 +230,6 @@ glance_rbd_store_chunk_size: 8
glance_service_in_ldap: false glance_service_in_ldap: false
# Cinder packages that must be installed before anything else
glance_requires_pip_packages:
- virtualenv
- httplib2
# Common pip packages # Common pip packages
glance_pip_packages: glance_pip_packages:
- cryptography - cryptography

View File

@ -42,4 +42,3 @@ dependencies:
when: when:
- ansible_pkg_mgr == 'apt' - ansible_pkg_mgr == 'apt'
- galera_client - galera_client
- openstack_openrc

View File

@ -0,0 +1,17 @@
---
features:
- |
The service setup in keystone for glance will now be executed
through delegation to the ``glance_service_setup_host`` which,
by default, is ``localhost`` (the deploy host). Deployers can
opt to rather change this to the utility container by implementing
the following override in ``user_variables.yml``.
.. code-block:: yaml
glance_service_setup_host: "{{ groups['utility_all'][0] }}"
deprecations:
- |
The variable ``glance_requires_pip_packages`` is no longer required
and has therefore been removed.

View File

@ -22,19 +22,6 @@
{% endfor %} {% endfor %}
when: glance_developer_mode | bool when: glance_developer_mode | bool
- name: Install requires pip packages
pip:
name: "{{ glance_requires_pip_packages }}"
state: "{{ glance_pip_package_state }}"
extra_args: >-
{{ glance_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }}
{{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }}
{{ pip_install_options | default('') }}
register: install_packages
until: install_packages|success
retries: 5
delay: 2
- name: Retrieve checksum for venv download - name: Retrieve checksum for venv download
uri: uri:
url: "{{ glance_venv_download_url | replace('tgz', 'checksum') }}" url: "{{ glance_venv_download_url | replace('tgz', 'checksum') }}"

View File

@ -13,83 +13,81 @@
# See the License for the specific language governing permissions and # See the License for the specific language governing permissions and
# limitations under the License. # limitations under the License.
# Create a service # We set the python interpreter to the ansible runtime venv if
- name: Ensure glance service # the delegation is to localhost so that we get access to the
keystone: # appropriate python libraries in that venv. If the delegation
command: "ensure_service" # is to another host, we assume that it is accessible by the
endpoint: "{{ keystone_service_adminurl }}" # system python instead.
login_user: "{{ keystone_admin_user_name }}" - name: Setup the service
login_password: "{{ keystone_auth_admin_password }}" delegate_to: "{{ glance_service_setup_host }}"
login_project_name: "{{ keystone_admin_tenant_name }}" vars:
service_name: "{{ glance_service_name }}" ansible_python_interpreter: >-
service_type: "{{ glance_service_type }}" {{ (glance_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_python['executable']) }}
description: "{{ glance_service_description }}" block:
insecure: "{{ keystone_service_adminuri_insecure }}" - name: Add service to the keystone service catalog
register: add_service os_keystone_service:
until: add_service|success cloud: default
retries: 5 state: present
delay: 2 name: "{{ glance_service_name }}"
no_log: True service_type: "{{ glance_service_type }}"
description: "{{ glance_service_description }}"
endpoint_type: admin
verify: "{{ not keystone_service_adminuri_insecure }}"
register: add_service
until: add_service is success
retries: 5
delay: 10
# Create an admin user - name: Add service user
- name: Ensure glance user os_user:
keystone: cloud: default
command: "ensure_user" state: present
endpoint: "{{ keystone_service_adminurl }}" name: "{{ glance_service_user_name }}"
login_user: "{{ keystone_admin_user_name }}" password: "{{ glance_service_password }}"
login_password: "{{ keystone_auth_admin_password }}" domain: default
login_project_name: "{{ keystone_admin_tenant_name }}" default_project: "{{ glance_service_project_name }}"
user_name: "{{ glance_service_user_name }}" endpoint_type: admin
tenant_name: "{{ glance_service_project_name }}" verify: "{{ not keystone_service_adminuri_insecure }}"
password: "{{ glance_service_password }}" register: add_service
insecure: "{{ keystone_service_adminuri_insecure }}" when: not glance_service_in_ldap | bool
register: add_service until: add_service is success
when: not glance_service_in_ldap | bool retries: 5
until: add_service|success delay: 10
retries: 5 no_log: True
delay: 10
no_log: True
# Add a role to the user - name: Add service user to admin role
- name: Ensure glance user to admin role os_user_role:
keystone: cloud: default
command: "ensure_user_role" state: present
endpoint: "{{ keystone_service_adminurl }}" user: "{{ glance_service_user_name }}"
login_user: "{{ keystone_admin_user_name }}" role: "{{ glance_role_name }}"
login_password: "{{ keystone_auth_admin_password }}" project: "{{ glance_service_project_name }}"
login_project_name: "{{ keystone_admin_tenant_name }}" endpoint_type: admin
user_name: "{{ glance_service_user_name }}" verify: "{{ not keystone_service_adminuri_insecure }}"
tenant_name: "{{ glance_service_project_name }}" register: add_service
role_name: "{{ glance_role_name }}" when: not glance_service_in_ldap | bool
insecure: "{{ keystone_service_adminuri_insecure }}" until: add_service is success
register: add_service retries: 5
when: not glance_service_in_ldap | bool delay: 10
until: add_service|success
retries: 5
delay: 10
no_log: True
# Create an endpoint - name: Add endpoints to keystone endpoint catalog
- name: Ensure glance endpoint os_keystone_endpoint:
keystone: cloud: default
command: "ensure_endpoint" state: present
endpoint: "{{ keystone_service_adminurl }}" service: "{{ glance_service_name }}"
login_user: "{{ keystone_admin_user_name }}" endpoint_interface: "{{ item.interface }}"
login_password: "{{ keystone_auth_admin_password }}" url: "{{ item.url }}"
login_project_name: "{{ keystone_admin_tenant_name }}" region: "{{ glance_service_region }}"
region_name: "{{ glance_service_region }}" endpoint_type: admin
service_name: "{{ glance_service_name }}" verify: "{{ not keystone_service_adminuri_insecure }}"
service_type: "{{ glance_service_type }}" register: add_service
insecure: "{{ keystone_service_adminuri_insecure }}" until: add_service is success
endpoint_list: retries: 5
- url: "{{ glance_service_publicurl }}" delay: 10
interface: "public" with_items:
- url: "{{ glance_service_internalurl }}" - interface: "public"
interface: "internal" url: "{{ glance_service_publicurl }}"
- url: "{{ glance_service_adminurl }}" - interface: "internal"
interface: "admin" url: "{{ glance_service_internalurl }}"
register: add_service - interface: "admin"
until: add_service|success url: "{{ glance_service_adminurl }}"
retries: 5
delay: 10
no_log: True

View File

@ -16,5 +16,3 @@
bridges: bridges:
- name: "br-mgmt" - name: "br-mgmt"
ip_addr: "10.1.0.1" ip_addr: "10.1.0.1"
ansible_python_interpreter: "/usr/bin/python2"