From c659733d39c1c3e4739db272645d80e7985e8883 Mon Sep 17 00:00:00 2001
From: Adam Vinsh <adam.vinsh@twcable.com>
Date: Tue, 17 May 2016 15:28:00 -0400
Subject: [PATCH] Add hooks for external install & svc management

This adds defined anchor points for external modules to hook into the
software install, config and service dependency chain.  This allows
external modules to manage software installation (virtualenv,
containers, etc) and service management (pacemaker) without needing rely
on resources that may change or be renamed.

Change-Id: I00cf4846bb933291469be94c9debed425eddf798
---
 manifests/auth_file.pp                        |  3 +
 manifests/bench.pp                            |  2 +
 manifests/client.pp                           |  3 +-
 manifests/config.pp                           |  1 +
 manifests/deps.pp                             | 59 +++++++++++++++++++
 manifests/dispersion.pp                       |  8 +--
 manifests/init.pp                             |  7 ++-
 manifests/keystone/auth.pp                    |  2 +
 manifests/keystone/dispersion.pp              |  2 +
 manifests/objectexpirer.pp                    |  1 +
 manifests/proxy.pp                            |  1 +
 manifests/proxy/account_quotas.pp             |  3 +
 manifests/proxy/authtoken.pp                  |  4 ++
 manifests/proxy/bulk.pp                       |  3 +
 manifests/proxy/cache.pp                      |  2 +
 manifests/proxy/catch_errors.pp               |  2 +
 manifests/proxy/ceilometer.pp                 |  4 +-
 manifests/proxy/container_quotas.pp           |  3 +
 manifests/proxy/crossdomain.pp                |  2 +
 manifests/proxy/dlo.pp                        |  2 +
 manifests/proxy/formpost.pp                   |  2 +
 manifests/proxy/gatekeeper.pp                 |  2 +
 manifests/proxy/healthcheck.pp                |  2 +
 manifests/proxy/keystone.pp                   |  2 +
 manifests/proxy/proxy_logging.pp              |  2 +
 manifests/proxy/ratelimit.pp                  |  2 +
 manifests/proxy/s3token.pp                    |  2 +
 manifests/proxy/slo.pp                        |  2 +
 manifests/proxy/staticweb.pp                  |  2 +
 manifests/proxy/swauth.pp                     |  3 +
 manifests/proxy/swift3.pp                     |  3 +-
 manifests/proxy/tempauth.pp                   |  2 +
 manifests/proxy/tempurl.pp                    |  2 +
 manifests/ringbuilder.pp                      |  1 +
 manifests/ringbuilder/create.pp               |  3 +
 manifests/ringbuilder/rebalance.pp            |  3 +
 manifests/ringserver.pp                       |  1 +
 manifests/ringsync.pp                         |  2 +
 manifests/service.pp                          |  1 +
 manifests/storage.pp                          |  2 +
 manifests/storage/account.pp                  |  1 +
 manifests/storage/all.pp                      |  2 +
 manifests/storage/container.pp                |  2 +
 manifests/storage/disk.pp                     | 11 +++-
 manifests/storage/ext4.pp                     |  2 +
 manifests/storage/filter/healthcheck.pp       |  2 +
 manifests/storage/filter/recon.pp             |  2 +
 manifests/storage/generic.pp                  |  9 +--
 manifests/storage/loopback.pp                 | 15 +++--
 manifests/storage/mount.pp                    | 14 +++--
 manifests/storage/node.pp                     |  2 +
 manifests/storage/object.pp                   |  1 +
 manifests/storage/server.pp                   |  2 +
 manifests/storage/xfs.pp                      | 10 +++-
 manifests/test_file.pp                        |  4 ++
 manifests/xfs.pp                              |  2 +
 ...l_install_mgmt_hooks-32ca80d2280efc53.yaml | 10 ++++
 spec/acceptance/basic_swift_spec.rb           |  4 --
 spec/classes/swift_client_spec.rb             |  2 +-
 spec/classes/swift_dispersion_spec.rb         |  3 +-
 spec/classes/swift_proxy_spec.rb              |  9 +++
 spec/classes/swift_spec.rb                    |  6 +-
 spec/defines/swift_storage_generic_spec.rb    |  3 +-
 63 files changed, 237 insertions(+), 36 deletions(-)
 create mode 100644 manifests/deps.pp
 create mode 100644 releasenotes/notes/external_install_mgmt_hooks-32ca80d2280efc53.yaml

diff --git a/manifests/auth_file.pp b/manifests/auth_file.pp
index 78d297ca..ec9d1f99 100644
--- a/manifests/auth_file.pp
+++ b/manifests/auth_file.pp
@@ -25,11 +25,14 @@ class swift::auth_file (
   $auth_url        = 'http://127.0.0.1:5000/v2.0/'
 ) {
 
+  include ::swift::deps
+
   file { '/root/swiftrc':
     ensure  => file,
     owner   => 'root',
     group   => 'root',
     mode    => '0600',
+    tag     => 'swift-file',
     content =>
   "
   export ST_USER=${admin_tenant}:${admin_user}
diff --git a/manifests/bench.pp b/manifests/bench.pp
index d390c595..b9f20405 100644
--- a/manifests/bench.pp
+++ b/manifests/bench.pp
@@ -84,6 +84,8 @@ class swift::bench (
   $delete            = 'yes',
 ){
 
+  include ::swift::deps
+
   swift_bench_config {
     'bench/auth':              value => $auth_url;
     'bench/user':              value => $swift_user;
diff --git a/manifests/client.pp b/manifests/client.pp
index 088d9731..b52af79d 100644
--- a/manifests/client.pp
+++ b/manifests/client.pp
@@ -12,12 +12,13 @@ class swift::client (
   $ensure = 'present'
 ) {
 
+  include ::swift::deps
   include ::swift::params
 
   package { 'swiftclient':
     ensure => $ensure,
     name   => $::swift::params::client_package,
-    tag    => 'openstack',
+    tag    => ['openstack','swift-support-package']
   }
 
 }
diff --git a/manifests/config.pp b/manifests/config.pp
index 9f8a4fe0..50f2b22e 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -24,6 +24,7 @@ class swift::config (
   $swift_config        = {},
 ) {
 
+  include ::swift::deps
   validate_hash($swift_config)
 
   create_resources('swift_config', $swift_config)
diff --git a/manifests/deps.pp b/manifests/deps.pp
new file mode 100644
index 00000000..673d007d
--- /dev/null
+++ b/manifests/deps.pp
@@ -0,0 +1,59 @@
+# == Class: swift::deps
+#
+#  swift anchors and dependency management
+#
+class swift::deps {
+  # Setup anchors for install, config and service phases of the module.  These
+  # anchors allow external modules to hook the begin and end of any of these
+  # phases.  Package or service management can also be replaced by ensuring the
+  # package is absent or turning off service management and having the
+  # replacement depend on the appropriate anchors.  When applicable, end tags
+  # should be notified so that subscribers can determine if installation,
+  # config or service state changed and act on that if needed.
+  anchor { 'swift::install::begin': }
+  -> Package<| tag == 'swift-package'|>
+  ~> anchor { 'swift::install::end': }
+  -> anchor { 'swift::config::begin': }
+  -> Swift_config<||>
+  ~> anchor { 'swift::config::end': }
+  ~> anchor { 'swift::service::begin': }
+  ~> Service<| tag == 'swift-service' |>
+  ~> anchor { 'swift::service::end': }
+  ~> Swift_dispersion_config<||>
+
+  Anchor['swift::config::begin']
+  -> Swift_proxy_config<||>
+  ~> Anchor['swift::config::end']
+
+  Anchor['swift::config::begin']
+  -> Swift_object_config<||>
+  ~> Anchor['swift::config::end']
+
+  Anchor['swift::config::begin']
+  -> Swift_container_config<||>
+  ~> Anchor['swift::config::end']
+
+  Anchor['swift::config::begin']
+  -> Swift_account_config<||>
+  ~> Anchor['swift::config::end']
+
+  Anchor['swift::config::begin']
+  -> File<| tag == 'swift-file' |>
+  ~> Anchor['swift::config::end']
+
+  # Support packages need to be installed in the install phase, but we don't
+  # put them in the chain above because we don't want any false dependencies
+  # between packages with the swift-package tag and the swift-support-package
+  # tag.  Note: the package resources here will have a 'before' relationshop on
+  # the swift::install::end anchor.  The line between swift-support-package and
+  # swift-package should be whether or not swift services would need to be
+  # restarted if the package state was changed.
+  Anchor['swift::install::begin']
+  -> Package<| tag == 'swift-support-package'|>
+  -> Anchor['swift::install::end']
+
+  # Installation or config changes will always restart services.
+  Anchor['swift::install::end'] ~> Anchor['swift::service::begin']
+  Anchor['swift::config::end']  ~> Anchor['swift::service::begin']
+
+}
diff --git a/manifests/dispersion.pp b/manifests/dispersion.pp
index 36e9242b..3e1a899e 100644
--- a/manifests/dispersion.pp
+++ b/manifests/dispersion.pp
@@ -80,15 +80,15 @@ class swift::dispersion (
   $dump_json     = 'no'
 ) {
 
+  include ::swift::deps
   include ::swift::params
 
   Swift_dispersion_config<||> ~> Exec['swift-dispersion-populate']
 
   file { '/etc/swift/dispersion.conf':
-    ensure  => file,
-    owner   => 'swift',
-    group   => 'swift',
-    require => Package['swift'],
+    ensure => file,
+    owner  => 'swift',
+    group  => 'swift',
   }
 
   swift_dispersion_config {
diff --git a/manifests/init.pp b/manifests/init.pp
index cffe2ee9..662f8a19 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -62,6 +62,7 @@ class swift(
   $swift_hash_suffix      = undef,
 ) {
 
+  include ::swift::deps
   include ::swift::params
 
   if ($swift_hash_suffix == undef and $swift_hash_path_suffix == undef) {
@@ -85,7 +86,11 @@ class swift(
     ensure => $client_package_ensure;
   }
 
-  File { owner => 'swift', group => 'swift', require => Package['swift'] }
+  File {
+    owner   => 'swift',
+    group   => 'swift',
+    tag     => 'swift-file',
+  }
 
   file { '/etc/swift':
     ensure => directory,
diff --git a/manifests/keystone/auth.pp b/manifests/keystone/auth.pp
index 4b9ee423..516bc3af 100644
--- a/manifests/keystone/auth.pp
+++ b/manifests/keystone/auth.pp
@@ -183,6 +183,8 @@ class swift::keystone::auth(
   $admin_address          = undef,
 ) {
 
+  include ::swift::deps
+
   if $endpoint_prefix {
     warning('The endpoint_prefix parameter is deprecated, use public_url, internal_url and admin_url instead.')
   }
diff --git a/manifests/keystone/dispersion.pp b/manifests/keystone/dispersion.pp
index 1e1bcdc4..37ec651d 100644
--- a/manifests/keystone/dispersion.pp
+++ b/manifests/keystone/dispersion.pp
@@ -36,6 +36,8 @@ class swift::keystone::dispersion(
   $tenant    = 'services'
 ) {
 
+  include ::swift::deps
+
   keystone_user { $auth_user:
     ensure   => present,
     password => $auth_pass,
diff --git a/manifests/objectexpirer.pp b/manifests/objectexpirer.pp
index 0cd3d75d..27017256 100644
--- a/manifests/objectexpirer.pp
+++ b/manifests/objectexpirer.pp
@@ -81,6 +81,7 @@ class swift::objectexpirer(
   $service_provider              = $::swift::params::service_provider
 ) inherits ::swift::params {
 
+  include ::swift::deps
   Swift_config<| |> ~> Service['swift-object-expirer']
   Swift_object_expirer_config<||> ~> Service['swift-object-expirer']
 
diff --git a/manifests/proxy.pp b/manifests/proxy.pp
index 0e0292e2..fc070922 100644
--- a/manifests/proxy.pp
+++ b/manifests/proxy.pp
@@ -141,6 +141,7 @@ class swift::proxy(
   $service_provider          = $::swift::params::service_provider
 ) inherits ::swift::params {
 
+  include ::swift::deps
   Swift_config<| |> ~> Service['swift-proxy-server']
 
   validate_bool($account_autocreate)
diff --git a/manifests/proxy/account_quotas.pp b/manifests/proxy/account_quotas.pp
index d3a77c79..d921f15a 100644
--- a/manifests/proxy/account_quotas.pp
+++ b/manifests/proxy/account_quotas.pp
@@ -18,6 +18,9 @@
 # Configure Swift Account Quotas
 #
 class swift::proxy::account_quotas() {
+
+  include ::swift::deps
+
   concat::fragment { 'swift_account_quotas':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/account_quotas.conf.erb'),
diff --git a/manifests/proxy/authtoken.pp b/manifests/proxy/authtoken.pp
index 7e6cdb31..792d0b45 100644
--- a/manifests/proxy/authtoken.pp
+++ b/manifests/proxy/authtoken.pp
@@ -87,6 +87,8 @@ class swift::proxy::authtoken(
   $auth_admin_prefix   = false,
 ) {
 
+  include ::swift::deps
+
   if $auth_uri {
     $auth_uri_real = $auth_uri
   } else {
@@ -116,6 +118,8 @@ class swift::proxy::authtoken(
     owner                   => 'swift',
     group                   => 'swift',
     selinux_ignore_defaults => true,
+    require                 => Anchor['swift::config::begin'],
+    before                  => Anchor['swift::config::end'],
   }
 
   concat::fragment { 'swift_authtoken':
diff --git a/manifests/proxy/bulk.pp b/manifests/proxy/bulk.pp
index e5e1897d..a19c51bf 100644
--- a/manifests/proxy/bulk.pp
+++ b/manifests/proxy/bulk.pp
@@ -43,6 +43,9 @@ class swift::proxy::bulk(
   $max_deletes_per_request       = '10000',
   $yield_frequency               = '60',
 ) {
+
+  include ::swift::deps
+
   concat::fragment { 'swift_bulk':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/bulk.conf.erb'),
diff --git a/manifests/proxy/cache.pp b/manifests/proxy/cache.pp
index a4023f31..ba56d547 100644
--- a/manifests/proxy/cache.pp
+++ b/manifests/proxy/cache.pp
@@ -22,6 +22,8 @@ class swift::proxy::cache(
   $memcache_servers = ['127.0.0.1:11211']
 ) {
 
+  include ::swift::deps
+
   # require the memcached class if its on the same machine
   if grep(any2array($memcache_servers), '^127\.0\.0\.1') {
     Class['memcached'] -> Class['swift::proxy::cache']
diff --git a/manifests/proxy/catch_errors.pp b/manifests/proxy/catch_errors.pp
index c1f88fbc..50af8347 100644
--- a/manifests/proxy/catch_errors.pp
+++ b/manifests/proxy/catch_errors.pp
@@ -17,6 +17,8 @@
 #
 class swift::proxy::catch_errors() {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_catch_errors':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/catch_errors.conf.erb'),
diff --git a/manifests/proxy/ceilometer.pp b/manifests/proxy/ceilometer.pp
index c21b1a1f..993aa0ed 100644
--- a/manifests/proxy/ceilometer.pp
+++ b/manifests/proxy/ceilometer.pp
@@ -78,6 +78,8 @@ class swift::proxy::ceilometer(
   $group               = 'ceilometer',
 ) inherits swift {
 
+  include ::swift::deps
+
   if(is_array($rabbit_hosts)) {
     $rabbit_hosts_with_creds = prefix($rabbit_hosts, "${rabbit_user}:${rabbit_password}@")
   }
@@ -106,7 +108,7 @@ class swift::proxy::ceilometer(
 
   package { 'python-ceilometermiddleware':
     ensure => $ensure,
-    tag    => 'openstack',
+    tag    => ['openstack', 'swift-support-package'],
   }
 
 }
diff --git a/manifests/proxy/container_quotas.pp b/manifests/proxy/container_quotas.pp
index f423443a..38d43f1d 100644
--- a/manifests/proxy/container_quotas.pp
+++ b/manifests/proxy/container_quotas.pp
@@ -18,6 +18,9 @@
 # Configure Swift Container Quotas
 #
 class swift::proxy::container_quotas() {
+
+  include ::swift::deps
+
   concat::fragment { 'swift_container_quotas':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/container_quotas.conf.erb'),
diff --git a/manifests/proxy/crossdomain.pp b/manifests/proxy/crossdomain.pp
index 6530ded4..a2dac1f6 100644
--- a/manifests/proxy/crossdomain.pp
+++ b/manifests/proxy/crossdomain.pp
@@ -15,6 +15,8 @@ class swift::proxy::crossdomain (
   $cross_domain_policy = '<allow-access-from domain="*" secure="false" />',
 ) {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_crossdomain':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/crossdomain.conf.erb'),
diff --git a/manifests/proxy/dlo.pp b/manifests/proxy/dlo.pp
index ca14547a..b086efa2 100644
--- a/manifests/proxy/dlo.pp
+++ b/manifests/proxy/dlo.pp
@@ -34,6 +34,8 @@ class swift::proxy::dlo (
   $max_get_time                = '86400'
 ) {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_dlo':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/dlo.conf.erb'),
diff --git a/manifests/proxy/formpost.pp b/manifests/proxy/formpost.pp
index 597ef301..03a92dc0 100644
--- a/manifests/proxy/formpost.pp
+++ b/manifests/proxy/formpost.pp
@@ -17,6 +17,8 @@
 #
 class swift::proxy::formpost() {
 
+  include ::swift::deps
+
   concat::fragment { 'swift-proxy-formpost':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/formpost.conf.erb'),
diff --git a/manifests/proxy/gatekeeper.pp b/manifests/proxy/gatekeeper.pp
index 95d8237d..0bb5304b 100644
--- a/manifests/proxy/gatekeeper.pp
+++ b/manifests/proxy/gatekeeper.pp
@@ -43,6 +43,8 @@ class swift::proxy::gatekeeper(
   $log_address  = '/dev/log'
 ) {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_gatekeeper':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/gatekeeper.conf.erb'),
diff --git a/manifests/proxy/healthcheck.pp b/manifests/proxy/healthcheck.pp
index 6ab6da38..cf408c3c 100644
--- a/manifests/proxy/healthcheck.pp
+++ b/manifests/proxy/healthcheck.pp
@@ -15,6 +15,8 @@
 #
 class swift::proxy::healthcheck() {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_healthcheck':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/healthcheck.conf.erb'),
diff --git a/manifests/proxy/keystone.pp b/manifests/proxy/keystone.pp
index ecbfd69f..9517abdd 100644
--- a/manifests/proxy/keystone.pp
+++ b/manifests/proxy/keystone.pp
@@ -29,6 +29,8 @@ class swift::proxy::keystone(
   $reseller_prefix     = 'AUTH_'
 ) {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_keystone':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/keystone.conf.erb'),
diff --git a/manifests/proxy/proxy_logging.pp b/manifests/proxy/proxy_logging.pp
index d9d353a5..e3a8677b 100644
--- a/manifests/proxy/proxy_logging.pp
+++ b/manifests/proxy/proxy_logging.pp
@@ -7,6 +7,8 @@
 #
 class swift::proxy::proxy_logging {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_proxy-logging':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/proxy-logging.conf.erb'),
diff --git a/manifests/proxy/ratelimit.pp b/manifests/proxy/ratelimit.pp
index 7b465b34..87ba78d5 100644
--- a/manifests/proxy/ratelimit.pp
+++ b/manifests/proxy/ratelimit.pp
@@ -48,6 +48,8 @@ class swift::proxy::ratelimit(
   $account_ratelimit = 0
 ) {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_ratelimit':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/ratelimit.conf.erb'),
diff --git a/manifests/proxy/s3token.pp b/manifests/proxy/s3token.pp
index 8b5dff89..2392eb0b 100644
--- a/manifests/proxy/s3token.pp
+++ b/manifests/proxy/s3token.pp
@@ -34,6 +34,8 @@ class swift::proxy::s3token(
   $auth_protocol = 'http'
 ) {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_s3token':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/s3token.conf.erb'),
diff --git a/manifests/proxy/slo.pp b/manifests/proxy/slo.pp
index 20601be8..d8249bd8 100644
--- a/manifests/proxy/slo.pp
+++ b/manifests/proxy/slo.pp
@@ -49,6 +49,8 @@ class swift::proxy::slo (
   $max_get_time                = '86400'
 ) {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_slo':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/slo.conf.erb'),
diff --git a/manifests/proxy/staticweb.pp b/manifests/proxy/staticweb.pp
index 18c2f9f8..add9b1ae 100644
--- a/manifests/proxy/staticweb.pp
+++ b/manifests/proxy/staticweb.pp
@@ -18,6 +18,8 @@
 #
 class swift::proxy::staticweb() {
 
+  include ::swift::deps
+
   concat::fragment { 'swift-proxy-staticweb':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/staticweb.conf.erb'),
diff --git a/manifests/proxy/swauth.pp b/manifests/proxy/swauth.pp
index 923e9b7e..b9f938a7 100644
--- a/manifests/proxy/swauth.pp
+++ b/manifests/proxy/swauth.pp
@@ -21,9 +21,12 @@ class swift::proxy::swauth(
   $package_ensure = 'present'
 ) {
 
+  include ::swift::deps
+
   package { 'python-swauth':
     ensure => $package_ensure,
     before => Package['swift-proxy'],
+    tag    => 'swift-package',
   }
 
   concat::fragment { 'swift_proxy_swauth':
diff --git a/manifests/proxy/swift3.pp b/manifests/proxy/swift3.pp
index dec0e0de..4511badd 100644
--- a/manifests/proxy/swift3.pp
+++ b/manifests/proxy/swift3.pp
@@ -24,12 +24,13 @@ class swift::proxy::swift3(
   $ensure = 'present'
 ) {
 
+  include ::swift::deps
   include ::swift::params
 
   package { 'swift-plugin-s3':
     ensure => $ensure,
     name   => $::swift::params::swift3,
-    tag    => 'openstack',
+    tag    => ['openstack','swift-package']
   }
 
   concat::fragment { 'swift_swift3':
diff --git a/manifests/proxy/tempauth.pp b/manifests/proxy/tempauth.pp
index e875b387..e8341e00 100644
--- a/manifests/proxy/tempauth.pp
+++ b/manifests/proxy/tempauth.pp
@@ -81,6 +81,8 @@ class swift::proxy::tempauth (
   $storage_url_scheme = undef,
 ) {
 
+  include ::swift::deps
+
   validate_array($account_user_list)
 
   if ($reseller_prefix) {
diff --git a/manifests/proxy/tempurl.pp b/manifests/proxy/tempurl.pp
index b58a4372..3c554180 100644
--- a/manifests/proxy/tempurl.pp
+++ b/manifests/proxy/tempurl.pp
@@ -52,6 +52,8 @@ class swift::proxy::tempurl (
   $outgoing_allow_headers  = undef,
 ) {
 
+  include ::swift::deps
+
   if($methods) {
     if is_array($methods) {
       $methods_real = join($methods,' ')
diff --git a/manifests/ringbuilder.pp b/manifests/ringbuilder.pp
index 4fe0416b..0eaeb6f4 100644
--- a/manifests/ringbuilder.pp
+++ b/manifests/ringbuilder.pp
@@ -30,6 +30,7 @@ class swift::ringbuilder(
   $min_part_hours = undef
 ) {
 
+  include ::swift::deps
   Class['swift'] -> Class['swift::ringbuilder']
 
   swift::ringbuilder::create{ ['object', 'account', 'container']:
diff --git a/manifests/ringbuilder/create.pp b/manifests/ringbuilder/create.pp
index 68e4dd6b..d959f1a2 100644
--- a/manifests/ringbuilder/create.pp
+++ b/manifests/ringbuilder/create.pp
@@ -39,6 +39,8 @@ define swift::ringbuilder::create(
   $user = 'swift'
 ) {
 
+  include ::swift::deps
+
   validate_re($name, '^object|container|account$')
 
   exec { "create_${name}":
@@ -46,6 +48,7 @@ define swift::ringbuilder::create(
     path    => ['/usr/bin'],
     user    => $user,
     creates => "/etc/swift/${name}.builder",
+    before  => Anchor['swift::config::end'],
   }
 
 }
diff --git a/manifests/ringbuilder/rebalance.pp b/manifests/ringbuilder/rebalance.pp
index c028bd48..256249e7 100644
--- a/manifests/ringbuilder/rebalance.pp
+++ b/manifests/ringbuilder/rebalance.pp
@@ -12,6 +12,8 @@ define swift::ringbuilder::rebalance(
   $seed = undef
 ) {
 
+  include ::swift::deps
+
   validate_re($name, '^object|container|account$')
   if $seed {
     validate_re($seed, '^\d+$')
@@ -21,5 +23,6 @@ define swift::ringbuilder::rebalance(
     command     => strip("swift-ring-builder /etc/swift/${name}.builder rebalance ${seed}"),
     path        => ['/usr/bin'],
     refreshonly => true,
+    before      => Anchor['swift::config::end'],
   }
 }
diff --git a/manifests/ringserver.pp b/manifests/ringserver.pp
index 9e6db0e2..9f9f1959 100644
--- a/manifests/ringserver.pp
+++ b/manifests/ringserver.pp
@@ -30,6 +30,7 @@ class swift::ringserver(
   $max_connections = 5
 ) {
 
+  include ::swift::deps
   Class['swift::ringbuilder'] -> Class['swift::ringserver']
 
   if !defined(Class['rsync::server']) {
diff --git a/manifests/ringsync.pp b/manifests/ringsync.pp
index 5e41fdb6..7a89c442 100644
--- a/manifests/ringsync.pp
+++ b/manifests/ringsync.pp
@@ -7,6 +7,8 @@ define swift::ringsync(
   $ring_server
 ) {
 
+  include ::swift::deps
+
   Exec { path => '/usr/bin' }
 
   rsync::get { "/etc/swift/${name}.ring.gz":
diff --git a/manifests/service.pp b/manifests/service.pp
index 4682c4b9..91de0357 100644
--- a/manifests/service.pp
+++ b/manifests/service.pp
@@ -39,6 +39,7 @@ define swift::service(
   $service_provider = $::swift::params::service_provider,
 ) {
 
+  include ::swift::deps
   include ::swift::params
 
   if(! member($::swift::params::swift_init_service_names, $name)) {
diff --git a/manifests/storage.pp b/manifests/storage.pp
index 61b893d4..1f1d200e 100644
--- a/manifests/storage.pp
+++ b/manifests/storage.pp
@@ -23,6 +23,8 @@ class swift::storage(
   $storage_local_net_ip
 ) {
 
+  include ::swift::deps
+
   if !defined(Class['rsync::server']){
     class{ '::rsync::server':
       use_xinetd => true,
diff --git a/manifests/storage/account.pp b/manifests/storage/account.pp
index 252e2236..69607bfe 100644
--- a/manifests/storage/account.pp
+++ b/manifests/storage/account.pp
@@ -34,6 +34,7 @@ class swift::storage::account(
   $service_provider = $::swift::params::service_provider
 ) inherits ::swift::params {
 
+  include ::swift::deps
   Swift_config<| |> ~> Service['swift-account-reaper']
 
   swift::storage::generic { 'account':
diff --git a/manifests/storage/all.pp b/manifests/storage/all.pp
index 84d9e30b..886a152c 100644
--- a/manifests/storage/all.pp
+++ b/manifests/storage/all.pp
@@ -91,6 +91,8 @@ class swift::storage::all(
   $outgoing_chmod     = 'Du=rwx,g=rx,o=rx,Fu=rw,g=r,o=r',
 ) {
 
+  include ::swift::deps
+
   class { '::swift::storage':
     storage_local_net_ip => $storage_local_net_ip,
   }
diff --git a/manifests/storage/container.pp b/manifests/storage/container.pp
index d7fe0a50..86eaad27 100644
--- a/manifests/storage/container.pp
+++ b/manifests/storage/container.pp
@@ -40,6 +40,8 @@ class swift::storage::container(
   $service_provider = $::swift::params::service_provider
 ) inherits ::swift::params {
 
+  include ::swift::deps
+
   Swift_config<| |> ~> Service['swift-container-updater']
 
   swift::storage::generic { 'container':
diff --git a/manifests/storage/disk.pp b/manifests/storage/disk.pp
index 561fe051..ecc9536c 100644
--- a/manifests/storage/disk.pp
+++ b/manifests/storage/disk.pp
@@ -49,11 +49,15 @@ define swift::storage::disk(
   $byte_size    = '1024',
 ) {
 
+  include ::swift::deps
+
   if(!defined(File[$mnt_base_dir])) {
     file { $mnt_base_dir:
-      ensure => directory,
-      owner  => 'swift',
-      group  => 'swift',
+      ensure  => directory,
+      owner   => 'swift',
+      group   => 'swift',
+      require => Anchor['swift::config::begin'],
+      before  => Anchor['swift::config::end'],
     }
   }
 
@@ -61,6 +65,7 @@ define swift::storage::disk(
     command => "parted -s ${base_dir}/${name} mklabel gpt",
     path    => ['/usr/bin/', '/sbin','/bin'],
     onlyif  => ["test -b ${base_dir}/${name}","parted ${base_dir}/${name} print|tail -1|grep 'Error'"],
+    before  => Anchor['swift::config::end'],
   }
 
   swift::storage::xfs { $name:
diff --git a/manifests/storage/ext4.pp b/manifests/storage/ext4.pp
index 2a96009c..da43be6d 100644
--- a/manifests/storage/ext4.pp
+++ b/manifests/storage/ext4.pp
@@ -29,12 +29,14 @@ define swift::storage::ext4(
   $loopback     = false
 ) {
 
+  include ::swift::deps
   # does this have to be refreshonly?
   # how can I know if this drive has been formatted?
   exec { "mkfs-${name}":
     command     => "mkfs.ext4 -I ${byte_size} -F ${device}",
     path        => ['/sbin/'],
     refreshonly => true,
+    before      => Anchor['swift::config::end'],
   }
 
   swift::storage::mount { $name:
diff --git a/manifests/storage/filter/healthcheck.pp b/manifests/storage/filter/healthcheck.pp
index dba89ab7..1dbf9d65 100644
--- a/manifests/storage/filter/healthcheck.pp
+++ b/manifests/storage/filter/healthcheck.pp
@@ -17,6 +17,8 @@
 define swift::storage::filter::healthcheck(
 ) {
 
+  include ::swift::deps
+
   concat::fragment { "swift_healthcheck_${name}":
     target  => "/etc/swift/${name}-server.conf",
     content => template('swift/proxy/healthcheck.conf.erb'),
diff --git a/manifests/storage/filter/recon.pp b/manifests/storage/filter/recon.pp
index 6a8c5263..65a7e4be 100644
--- a/manifests/storage/filter/recon.pp
+++ b/manifests/storage/filter/recon.pp
@@ -22,6 +22,8 @@ define swift::storage::filter::recon(
   $cache_path = '/var/cache/swift'
 ) {
 
+  include ::swift::deps
+
   concat::fragment { "swift_recon_${name}":
     target  => "/etc/swift/${name}-server.conf",
     content => template('swift/recon.conf.erb'),
diff --git a/manifests/storage/generic.pp b/manifests/storage/generic.pp
index 7dd84965..18143eea 100644
--- a/manifests/storage/generic.pp
+++ b/manifests/storage/generic.pp
@@ -38,6 +38,7 @@ define swift::storage::generic(
   $service_provider = $::swift::params::service_provider
 ) {
 
+  include ::swift::deps
   include ::swift::params
 
   Class['swift::storage'] -> Swift::Storage::Generic[$name]
@@ -55,10 +56,10 @@ define swift::storage::generic(
   }
 
   file { "/etc/swift/${name}-server/":
-    ensure  => directory,
-    owner   => 'swift',
-    group   => 'swift',
-    require => Package["swift-${name}"],
+    ensure => directory,
+    owner  => 'swift',
+    group  => 'swift',
+    tag    => 'swift-file',
   }
 
   if $manage_service {
diff --git a/manifests/storage/loopback.pp b/manifests/storage/loopback.pp
index 77d619a0..78ba0aea 100644
--- a/manifests/storage/loopback.pp
+++ b/manifests/storage/loopback.pp
@@ -38,17 +38,23 @@ define swift::storage::loopback(
   $fstype       = 'xfs'
 ) {
 
+  include ::swift::deps
+
   if(!defined(File[$base_dir])) {
     file { $base_dir:
-      ensure => directory,
+      ensure  => directory,
+      require => Anchor['swift::config::begin'],
+      before  => Anchor['swift::config::end'],
     }
   }
 
   if(!defined(File[$mnt_base_dir])) {
     file { $mnt_base_dir:
-      ensure => directory,
-      owner  => 'swift',
-      group  => 'swift',
+      ensure  => directory,
+      owner   => 'swift',
+      group   => 'swift',
+      require => Anchor['swift::config::begin'],
+      before  => Anchor['swift::config::end'],
     }
   }
 
@@ -57,6 +63,7 @@ define swift::storage::loopback(
     path    => ['/usr/bin/', '/bin'],
     unless  => "test -f ${base_dir}/${name}",
     require => File[$base_dir],
+    before  => Anchor['swift::config::end'],
   }
 
   $storage_params = {
diff --git a/manifests/storage/mount.pp b/manifests/storage/mount.pp
index e77e2bf2..a121576f 100644
--- a/manifests/storage/mount.pp
+++ b/manifests/storage/mount.pp
@@ -28,6 +28,8 @@ define swift::storage::mount(
   $fstype       = 'xfs'
 ) {
 
+  include ::swift::deps
+
   if($loopback){
     $options = 'noatime,nodiratime,nobarrier,loop'
   } else {
@@ -43,9 +45,11 @@ define swift::storage::mount(
   # the directory that represents the mount point
   # needs to exist
   file { "${mnt_base_dir}/${name}":
-    ensure => directory,
-    owner  => 'swift',
-    group  => 'swift',
+    ensure  => directory,
+    owner   => 'swift',
+    group   => 'swift',
+    require => Anchor['swift::config::begin'],
+    before  => Anchor['swift::config::end'],
   }
 
   mount { "${mnt_base_dir}/${name}":
@@ -64,6 +68,7 @@ define swift::storage::mount(
     unless    => "grep ${mnt_base_dir}/${name} /etc/mtab",
     # TODO - this needs to be removed when I am done testing
     logoutput => true,
+    before    => Anchor['swift::config::end'],
   }
 
   exec { "fix_mount_permissions_${name}":
@@ -71,6 +76,7 @@ define swift::storage::mount(
     path        => ['/usr/sbin', '/bin'],
     subscribe   => Exec["mount_${name}"],
     refreshonly => true,
+    before      => Anchor['swift::config::end'],
   }
 
   # mounting in linux and puppet is broken and non-atomic
@@ -85,7 +91,7 @@ define swift::storage::mount(
       command     => "restorecon ${mnt_base_dir}/${name}",
       path        => ['/usr/sbin', '/sbin'],
       subscribe   => Exec["mount_${name}"],
-      before      =>  Exec["fix_mount_permissions_${name}"],
+      before      =>  [Exec["fix_mount_permissions_${name}"],Anchor['swift::config::end']],
       refreshonly => true,
     }
   }
diff --git a/manifests/storage/node.pp b/manifests/storage/node.pp
index fcaee1ad..30f3c514 100644
--- a/manifests/storage/node.pp
+++ b/manifests/storage/node.pp
@@ -55,6 +55,8 @@ define swift::storage::node(
   $manage_ring = true
 ) {
 
+  include ::swift::deps
+
   validate_re($zone, '^\d+$', 'The zone parameter must be an integer')
 
   Swift::Storage::Server {
diff --git a/manifests/storage/object.pp b/manifests/storage/object.pp
index 259fc53a..f73a4b02 100644
--- a/manifests/storage/object.pp
+++ b/manifests/storage/object.pp
@@ -34,6 +34,7 @@ class swift::storage::object(
   $service_provider = $::swift::params::service_provider
 ) inherits ::swift::params {
 
+  include ::swift::deps
   Swift_config<| |> ~> Service['swift-object-updater']
 
   swift::storage::generic { 'object':
diff --git a/manifests/storage/server.pp b/manifests/storage/server.pp
index ab6a5d7c..9eb9693c 100644
--- a/manifests/storage/server.pp
+++ b/manifests/storage/server.pp
@@ -137,6 +137,8 @@ define swift::storage::server(
   $config_file_path       = "${type}-server.conf",
 ) {
 
+  include ::swift::deps
+
   if ($incoming_chmod == '0644') {
     warning('The default incoming_chmod set to 0644 may yield in error prone directories and will be changed in a later release.')
   }
diff --git a/manifests/storage/xfs.pp b/manifests/storage/xfs.pp
index 974ef7c0..3de40dce 100644
--- a/manifests/storage/xfs.pp
+++ b/manifests/storage/xfs.pp
@@ -35,6 +35,7 @@ define swift::storage::xfs(
   $loopback     = false
 ) {
 
+  include ::swift::deps
   include ::swift::xfs
 
   if $device == '' {
@@ -45,9 +46,11 @@ define swift::storage::xfs(
 
   if(!defined(File[$mnt_base_dir])) {
     file { $mnt_base_dir:
-      ensure => directory,
-      owner  => 'swift',
-      group  => 'swift',
+      ensure  => directory,
+      owner   => 'swift',
+      group   => 'swift',
+      require => Anchor['swift::config::begin'],
+      before  => Anchor['swift::config::end'],
     }
   }
 
@@ -60,6 +63,7 @@ define swift::storage::xfs(
     path    => ['/sbin/', '/usr/sbin/'],
     require => Package['xfsprogs'],
     unless  => "xfs_admin -l ${target_device}",
+    before  => Anchor['swift::config::end'],
   }
 
   swift::storage::mount { $name:
diff --git a/manifests/test_file.pp b/manifests/test_file.pp
index c515f5be..3fe6e100 100644
--- a/manifests/test_file.pp
+++ b/manifests/test_file.pp
@@ -36,8 +36,12 @@ class swift::test_file (
   $tenant      = 'openstack',
   $user        = 'admin'
 ) {
+
+  include ::swift::deps
+
   file { '/tmp/swift_test_file.rb':
     mode    => '0755',
     content => template('swift/swift_keystone_test.erb'),
+    tag     => 'swift-file',
   }
 }
diff --git a/manifests/xfs.pp b/manifests/xfs.pp
index 86d19fc6..6a44e1e2 100644
--- a/manifests/xfs.pp
+++ b/manifests/xfs.pp
@@ -3,6 +3,8 @@
 # xfs partitions
 class swift::xfs {
 
+  include ::swift::deps
+
   $packages = ['xfsprogs', 'parted']
   ensure_packages($packages)
 
diff --git a/releasenotes/notes/external_install_mgmt_hooks-32ca80d2280efc53.yaml b/releasenotes/notes/external_install_mgmt_hooks-32ca80d2280efc53.yaml
new file mode 100644
index 00000000..eeb3c9b5
--- /dev/null
+++ b/releasenotes/notes/external_install_mgmt_hooks-32ca80d2280efc53.yaml
@@ -0,0 +1,10 @@
+---
+prelude: >
+    Add hooks for external install & svc management.
+features:
+  - This adds defined anchor points for external modules to
+    hook into the software install, config and service dependency
+    chain. This allows external modules to manage software
+    installation (virtualenv, containers, etc) and service management
+    (pacemaker) without needing rely on resources that may change or
+    be renamed.
diff --git a/spec/acceptance/basic_swift_spec.rb b/spec/acceptance/basic_swift_spec.rb
index e49c7971..c1f20fda 100644
--- a/spec/acceptance/basic_swift_spec.rb
+++ b/spec/acceptance/basic_swift_spec.rb
@@ -50,13 +50,11 @@ describe 'basic swift' do
         part_power     => '18',
         replicas       => '1',
         min_part_hours => 1,
-        require        => Class['swift'],
       }
       class { '::swift::proxy':
         proxy_local_net_ip => '127.0.0.1',
         pipeline           => ['healthcheck', 'proxy-logging', 'cache', 'authtoken', 'keystone', 'dlo', 'proxy-server'],
         account_autocreate => true,
-        require            => Class['swift::ringbuilder'],
       }
       class { '::swift::proxy::authtoken':
         admin_password => 'a_big_secret',
@@ -142,13 +140,11 @@ describe 'basic swift' do
         part_power     => '18',
         replicas       => '1',
         min_part_hours => 1,
-        require        => Class['swift'],
       }
       class { '::swift::proxy':
         proxy_local_net_ip => '127.0.0.1',
         pipeline           => ['healthcheck', 'proxy-logging', 'cache', 'authtoken', 'keystone', 'dlo', 'proxy-server'],
         account_autocreate => true,
-        require            => Class['swift::ringbuilder'],
         service_provider   => 'swiftinit',
       }
       class { '::swift::proxy::authtoken':
diff --git a/spec/classes/swift_client_spec.rb b/spec/classes/swift_client_spec.rb
index b4da0905..3e681a6c 100644
--- a/spec/classes/swift_client_spec.rb
+++ b/spec/classes/swift_client_spec.rb
@@ -21,7 +21,7 @@ describe 'swift::client' do
       is_expected.to contain_package('swiftclient').with(
         :name   => 'python-swiftclient',
         :ensure => p[:package_ensure],
-        :tag    => 'openstack'
+        :tag    => ['openstack','swift-support-package'],
       )
     end
 
diff --git a/spec/classes/swift_dispersion_spec.rb b/spec/classes/swift_dispersion_spec.rb
index 8aaf3e57..bd1c864e 100644
--- a/spec/classes/swift_dispersion_spec.rb
+++ b/spec/classes/swift_dispersion_spec.rb
@@ -31,8 +31,7 @@ describe 'swift::dispersion' do
   it { is_expected.to contain_file('/etc/swift/dispersion.conf').with(
     :ensure  => 'file',
     :owner   => 'swift',
-    :group   => 'swift',
-    :require => 'Package[swift]')
+    :group   => 'swift',)
   }
 
   shared_examples 'swift::dispersion' do
diff --git a/spec/classes/swift_proxy_spec.rb b/spec/classes/swift_proxy_spec.rb
index e0aa3d55..3aa914d1 100644
--- a/spec/classes/swift_proxy_spec.rb
+++ b/spec/classes/swift_proxy_spec.rb
@@ -37,6 +37,9 @@ describe 'swift::proxy' do
         {:proxy_local_net_ip => '127.0.0.1'}
       end
 
+      it { is_expected.to contain_package('swift-proxy').that_requires('Anchor[swift::install::begin]')
+           is_expected.to contain_package('swift-proxy').that_notifies('Anchor[swift::install::end]') }
+
       it { is_expected.to contain_service('swift-proxy-server').with(
         {:ensure     => 'running',
          :provider   => nil,
@@ -46,6 +49,12 @@ describe 'swift::proxy' do
          :tag        => 'swift-service',
         }
       )}
+      it { is_expected.to contain_concat('/etc/swift/proxy-server.conf').with(
+        {:ensure  => 'present',
+         :owner   => 'swift',
+         :group   => 'swift',
+        }
+      )}
 
       it 'should build the header file with all of the default contents' do
         is_expected.to contain_concat_fragment('swift_proxy').with_content('# This file is managed by puppet.  Do not edit
diff --git a/spec/classes/swift_spec.rb b/spec/classes/swift_spec.rb
index e4385767..ca04efe5 100644
--- a/spec/classes/swift_spec.rb
+++ b/spec/classes/swift_spec.rb
@@ -30,7 +30,7 @@ describe 'swift' do
       {
         :owner   => 'swift',
         :group   => 'swift',
-        :require => 'Package[swift]'
+        :tag     => 'swift-file',
       }
     end
     it {is_expected.to contain_user('swift')}
@@ -55,7 +55,9 @@ describe 'swift' do
       is_expected.to contain_swift_config(
         'swift-constraints/max_header_size').with_value('16384')
     end
-    it { is_expected.to contain_package('swift').with_ensure('present') }
+    it { is_expected.to contain_package('swift').with_ensure('present')
+         is_expected.to contain_package('swift').that_requires('Anchor[swift::install::begin]')
+         is_expected.to contain_package('swift').that_notifies('Anchor[swift::install::end]')}
     it { is_expected.to contain_file('/etc/swift/swift.conf').with_before(/Swift_config\[.+\]/) }
   end
 
diff --git a/spec/defines/swift_storage_generic_spec.rb b/spec/defines/swift_storage_generic_spec.rb
index 86821189..bc31884a 100644
--- a/spec/defines/swift_storage_generic_spec.rb
+++ b/spec/defines/swift_storage_generic_spec.rb
@@ -55,7 +55,8 @@ describe 'swift::storage::generic' do
               it do
                 is_expected.to contain_package("swift-#{t}").with(
                   :ensure => params[:package_ensure],
-                  :tag    => ['openstack', 'swift-package']
+                  :tag    => ['openstack', 'swift-package'],
+                  :notify => ['Anchor[swift::install::end]']
                 )
               end
               it do