Execute service setup against a delegated host using Ansible built-in modules

In order to reduce the packages required to pip install on to the hosts,
we allow the service setup to be delegated to a specific host, defaulting
to the deploy host. We also switch as many tasks as possible to using the
built-in Ansible modules which make use of the shade library.

The openstack_openrc role is now executed once on the designated host, so
it is no longer necessary to execute it using include_role here.

The zun_requires_pip_packages variable is not used and is therefore removed.

Depends-On: https://review.openstack.org/579233
Depends-On: https://review.openstack.org/579959
Change-Id: I7108b43109136aac46bc87a0c59827a202f87be8

defaults/main.yml

@@ -26,6 +26,11 @@ zun_ceilometer_enabled: False
 ## Verbosity Options
 debug: False
 
+# Set the host which will execute the shade modules
+# for the service setup. The host must already have
+# clouds.yaml properly configured.
+zun_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}"
+
 # Set the package install state for distribution and pip packages
 # Options are 'present' and 'latest'
 zun_package_state: "latest"
@@ -224,7 +229,6 @@ zun_services:
     execstarts: "{{ zun_bin }}/zun-wsproxy --config-dir /etc/zun"
 
 # Common pip packages
-zun_requires_pip_packages: []
 zun_pip_packages:
   - kuryr-libnetwork
   - oslo_rootwrap

tasks/zun_install.yml

@@ -30,19 +30,6 @@
   when:
     - zun_developer_mode | bool
 
-- name: Install required pip packages
-  pip:
-    name: "{{ zun_requires_pip_packages }}"
-    state: "{{ zun_pip_package_state }}"
-    extra_args: >-
-      {{ zun_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }}
-      {{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }}
-      {{ pip_install_options | default('') }}
-  register: install_packages
-  until: install_packages|success
-  retries: 5
-  delay: 2
-
 - name: Retrieve checksum for venv download
   uri:
     url: "{{ zun_venv_download_url | replace('tgz', 'checksum') }}"

tasks/zun_service_setup.yml

@@ -13,150 +13,91 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- name: Run the openstack openrc role
+# We set the python interpreter to the ansible runtime venv if
-  include_role:
+# the delegation is to localhost so that we get access to the
-    name: openstack_openrc
+# appropriate python libraries in that venv. If the delegation
-    private: true
+# is to another host, we assume that it is accessible by the
-
+# system python instead.
-# Create a service
+- name: Setup the service
-- name: Ensure zun service
+  delegate_to: "{{ zun_service_setup_host }}"
-  keystone:
+  vars:
-    command: "ensure_service"
+    ansible_python_interpreter: >-
-    endpoint: "{{ keystone_service_adminurl }}"
+      {{ (zun_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_python['executable']) }}
-    login_user: "{{ keystone_admin_user_name }}"
+  block:
-    login_password: "{{ keystone_auth_admin_password }}"
+    - name: Add service to the keystone service catalog
-    login_project_name: "{{ keystone_admin_tenant_name }}"
+      os_keystone_service:
-    service_name: "{{ zun_service_name }}"
+        cloud: default
+        state: present
+        name: "{{ zun_service_name }}"
         service_type: "{{ zun_service_type }}"
         description: "{{ zun_service_description }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
       register: add_service
-  until: add_service | success
+      until: add_service is success
       retries: 5
-  delay: 2
+      delay: 10
-  no_log: True
-  tags:
-    - zun-api-setup
-    - zun-service-add
-    - zun-setup
 
-# Create an admin user
+    - name: Add service user
-- name: Ensure zun user
+      os_user:
-  keystone:
+        cloud: default
-    command: "ensure_user"
+        state: present
-    endpoint: "{{ keystone_service_adminurl }}"
+        name: "{{ item.name }}"
-    login_user: "{{ keystone_admin_user_name }}"
+        password: "{{ item.password }}"
-    login_password: "{{ keystone_auth_admin_password }}"
+        domain: default
-    login_project_name: "{{ keystone_admin_tenant_name }}"
+        default_project: "{{ zun_service_project_name }}"
-    user_name: "{{ zun_service_user_name }}"
+        endpoint_type: admin
-    tenant_name: "{{ zun_service_project_name }}"
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service
+      when: not zun_service_in_ldap | bool
+      until: add_service is success
+      retries: 5
+      delay: 10
+      no_log: True
+      with_items:
+        - name: "{{ zun_service_user_name }}"
           password: "{{ zun_service_password }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
+        - name: "{{ zun_kuryr_service_username }}"
-  register: add_service
-  when:
-    - not zun_service_in_ldap | bool
-  until: add_service | success
-  retries: 5
-  delay: 10
-  no_log: True
-  tags:
-    - zun-api-setup
-    - zun-service-add
-    - zun-setup
-
-# Add a role to the user
-- name: Ensure zun user to admin role
-  keystone:
-    command: "ensure_user_role"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    user_name: "{{ zun_service_user_name }}"
-    tenant_name: "{{ zun_service_project_name }}"
-    role_name: "{{ zun_service_role_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-  register: add_service
-  when:
-    - not zun_service_in_ldap | bool
-  until: add_service | success
-  retries: 5
-  delay: 10
-  no_log: True
-  tags:
-    - zun-api-setup
-    - zun-service-add
-    - zun-setup
-
-# Create an endpoint
-- name: Ensure zun endpoint
-  keystone:
-    command: "ensure_endpoint"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    region_name: "{{ zun_service_region }}"
-    service_name: "{{ zun_service_name }}"
-    service_type: "{{ zun_service_type }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-    endpoint_list:
-      - url: "{{ zun_service_publicurl }}"
-        interface: "public"
-      - url: "{{ zun_service_internalurl }}"
-        interface: "internal"
-      - url: "{{ zun_service_adminurl }}"
-        interface: "admin"
-  register: add_service
-  until: add_service | success
-  retries: 5
-  delay: 10
-  no_log: True
-  tags:
-    - zun-api-setup
-    - zun-service-add
-    - zun-setup
-
-# Create an admin user
-- name: Ensure zun kuryr user
-  keystone:
-    command: "ensure_user"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    user_name: "{{ zun_kuryr_service_username }}"
-    tenant_name: "{{ zun_service_project_name }}"
           password: "{{ zun_kuryr_service_password }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
+      loop_control:
-  register: add_service
+        label: "{{ item.name }}"
-  when: not zun_service_in_ldap | bool
-  until: add_service | success
-  retries: 5
-  delay: 10
-  no_log: True
-  tags:
-    - zun-api-setup
-    - zun-service-add
 
-# Add a role to the user
+    - name: Add service user to admin role
-- name: Ensure zun kuryr user to admin role
+      os_user_role:
-  keystone:
+        cloud: default
-    command: "ensure_user_role"
+        state: present
-    endpoint: "{{ keystone_service_adminurl }}"
+        user: "{{ item }}"
-    login_user: "{{ keystone_admin_user_name }}"
+        role: "{{ zun_service_role_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
+        project: "{{ zun_service_project_name }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
+        endpoint_type: admin
-    user_name: "{{ zun_kuryr_service_username }}"
+        verify: "{{ not keystone_service_adminuri_insecure }}"
-    tenant_name: "{{ zun_service_project_name }}"
-    role_name: "{{ zun_service_role_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
       register: add_service
       when: not zun_service_in_ldap | bool
-  until: add_service | success
+      until: add_service is success
       retries: 5
       delay: 10
-  no_log: True
+      with_items:
-  tags:
+        - "{{ zun_service_user_name }}"
-    - zun-api-setup
+        - "{{ zun_kuryr_service_username }}"
-    - zun-service-add
+
+    - name: Add endpoints to keystone endpoint catalog
+      os_keystone_endpoint:
+        cloud: default
+        state: present
+        service: "{{ zun_service_name }}"
+        endpoint_interface: "{{ item.interface }}"
+        url: "{{ item.url }}"
+        region: "{{ zun_service_region }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service
+      until: add_service is success
+      retries: 5
+      delay: 10
+      with_items:
+        - interface: "public"
+          url: "{{ zun_service_publicurl }}"
+        - interface: "internal"
+          url: "{{ zun_service_internalurl }}"
+        - interface: "admin"
+          url: "{{ zun_service_adminurl }}"

tests/host_vars/localhost.yml

@@ -14,7 +14,6 @@
 # limitations under the License.
 
 ansible_host: 10.1.1.1
-ansible_python_interpreter: "/usr/bin/python2"
 
 neutron_provider_networks:
   network_types: "vxlan,flat"

tests/test-install-zun.yml

@@ -15,7 +15,7 @@
 
 - name: Installation and setup of Zun
   hosts: zun_all
-  become: true
+  remote_user: root
   roles:
     - role: "os_zun"
       zun_rabbitmq_password: secrete