Execute service setup against a delegated host using Ansible built-in modules

In order to reduce the packages required to pip install on to the hosts,
we allow the service setup to be delegated to a specific host, defaulting
to the deploy host. We also switch as many tasks as possible to using the
built-in Ansible modules which make use of the shade library.

The 'virtualenv' package is now installed appropriately by the openstack_hosts
role, so there's no need to install it any more. The 'httplib2' package is a
legacy Ansible requirement for the get_url/get_uri module which is no longer
needed. The keystone/glance/cinder client libraries are not required any more
now that we're using the upstream modules. As there are no required packages
left, the task to install them is also removed.

Depends-On: https://review.openstack.org/582359
Depends-On: https://review.openstack.org/582579
Depends-On: https://review.openstack.org/582957
Depends-On: https://review.openstack.org/583430
Change-Id: Id3b9d57981006d3f7abbb94af5f72214db3da6cb

defaults/main.yml

@@ -16,6 +16,11 @@
 ## Verbosity Options
 debug: False
 
+# Set the host which will execute the shade modules
+# for the service setup. The host must already have
+# clouds.yaml properly configured.
+magnum_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}"
+
 # Set the package install state for distribution and pip packages
 # Options are 'present' and 'latest'
 magnum_package_state: "latest"
@@ -118,13 +123,11 @@ magnum_glance_images: []
 #    distro: fedora-atomic              #Value for the os_distro metadata
 #    checksum: "sha1:dab00359cfa5cd393f0a6044f77c4a78c6167a47"
 
-magnum_requires_pip_packages:
-  - httplib2
-  - python-glanceclient
-  - python-keystoneclient
-  - pyyaml
-  - shade
-  - virtualenv
+# Set the directory where the downloaded images will be stored
+# on the magnum_service_setup_host host. If the host is localhost,
+# then the user running the playbook must have access to it.
+magnum_image_path: "{{ lookup('env', 'HOME') }}/openstack-ansible/magnum"
+magnum_image_path_owner: "{{ lookup('env', 'USER') }}"
 
 magnum_pip_packages:
   - magnum

releasenotes/notes/magnum-service-setup-host-ea285f161e625980.yaml

@@ -0,0 +1,22 @@
+---
+features:
+  - |
+    The service setup in keystone for magnum will now be executed
+    through delegation to the ``magnum_service_setup_host`` which,
+    by default, is ``localhost`` (the deploy host). Deployers can
+    opt to rather change this to the utility container by implementing
+    the following override in ``user_variables.yml``.
+
+    .. code-block:: yaml
+
+      magnum_service_setup_host: "{{ groups['utility_all'][0] }}"
+  - |
+    Instead of downloading images to the magnum API servers, the
+    images will now download to the ``magnum_service_setup_host`` to
+    the folder set in ``magnum_image_path`` owned by
+    ``magnum_image_path_owner``.
+
+deprecations:
+  - |
+    The variable ``magnum_requires_pip_packages`` is no longer required
+    and has therefore been removed.

tasks/magnum_install.yml

@@ -33,19 +33,6 @@
       {% endfor %}
   when: magnum_developer_mode | bool
 
-- name: Install requires pip packages
-  pip:
-    name: "{{ magnum_requires_pip_packages }}"
-    state: "{{ magnum_pip_package_state }}"
-    extra_args: >-
-      {{ magnum_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }}
-      {{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }}
-      {{ pip_install_options | default('') }}
-  register: install_packages
-  until: install_packages is success
-  retries: 5
-  delay: 2
-
 - name: Retrieve checksum for venv download
   uri:
     url: "{{ magnum_venv_download_url | replace('tgz', 'checksum') }}"

tasks/magnum_post_install.yml

@@ -37,26 +37,3 @@
       config_type: "ini"
   notify:
     - Restart magnum services
-
-- name: Download magnum images
-  get_url:
-    url: "{{ item.file }}"
-    dest: "/var/tmp/{{ item.file | basename }}"
-    checksum: "{{ item.checksum | default(omit) }}"
-  with_items: "{{ magnum_glance_images }}"
-  when: inventory_hostname == groups['magnum_all'][0]
-
-- name: Upload images to Glance
-  os_image:
-    cloud: default
-    endpoint_type: internal
-    validate_certs: "{{ keystone_service_internaluri_insecure | ternary(false, true) }}"
-    name: "{{ item.name }}"
-    disk_format: "{{ item.disk_format }}"
-    container_format: "{{ item.image_format }}"
-    is_public: "{{ item.public }}"
-    filename: "/var/tmp/{{ item.file | basename }}"
-    properties:
-      os_distro: "{{ item.distro }}"
-  with_items: "{{ magnum_glance_images }}"
-  when: inventory_hostname == groups['magnum_all'][0]

tasks/magnum_service_setup.yml

@@ -13,130 +13,160 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- name: Ensure the service for Magnum exists
-  keystone:
-    command: "ensure_service"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-    service_name: "{{ magnum_service_name }}"
-    service_type: "{{ magnum_service_type }}"
-    description: "{{ magnum_service_description }}"
-  register: add_magnum_service
-  until: add_magnum_service is success
-  retries: 5
-  delay: 2
-  no_log: True
+# We set the python interpreter to the ansible runtime venv if
+# the delegation is to localhost so that we get access to the
+# appropriate python libraries in that venv. If the delegation
+# is to another host, we assume that it is accessible by the
+# system python instead.
+- name: Setup the service
+  delegate_to: "{{ magnum_service_setup_host }}"
+  vars:
+    ansible_python_interpreter: >-
+      {{ (magnum_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_python['executable']) }}
+  block:
+    - name: Add service to the keystone service catalog
+      os_keystone_service:
+        cloud: default
+        state: present
+        name: "{{ magnum_service_name }}"
+        service_type: "{{ magnum_service_type }}"
+        description: "{{ magnum_service_description }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service
+      until: add_service is success
+      retries: 5
+      delay: 10
 
-- name: Ensure the magnum user exists
-  keystone:
-    command: "ensure_user"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-    user_name: "{{ magnum_service_user_name }}"
-    tenant_name: "{{ magnum_service_project_name }}"
-    password: "{{ magnum_service_password |default('changeme') }}"
-  register: add_magnum_user
-  until: add_magnum_user is success
-  retries: 5
-  delay: 2
-  no_log: True
+    - name: Add service user
+      os_user:
+        cloud: default
+        state: present
+        name: "{{ magnum_service_user_name }}"
+        password: "{{ magnum_service_password }}"
+        domain: default
+        default_project: "{{ magnum_service_project_name }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service_user
+      until: add_service_user is success
+      retries: 5
+      delay: 10
+      no_log: True
 
-- name: Ensure the magnum user has the admin role
-  keystone:
-    command: "ensure_user_role"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    user_name: "{{ magnum_service_user_name }}"
-    tenant_name: "{{ magnum_service_project_name }}"
-    role_name: "{{ item }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-  register: ensure_magnum_roles
-  until: ensure_magnum_roles is success
-  retries: 5
-  delay: 2
-  with_items: "{{ magnum_service_role_names }}"
-  no_log: True
+    - name: Add service user to admin roles
+      os_user_role:
+        cloud: default
+        state: present
+        user: "{{ magnum_service_user_name }}"
+        role: "{{ item }}"
+        project: "{{ magnum_service_project_name }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service_user_role
+      until: add_service_user_role is success
+      retries: 5
+      delay: 10
+      with_items: "{{ magnum_service_role_names }}"
 
-- name: Ensure the magnum endpoint is registered
-  keystone:
-    command: "ensure_endpoint"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-    region_name: "{{ magnum_service_region }}"
-    service_name: "{{ magnum_service_name }}"
-    service_type: "{{ magnum_service_type }}"
-    endpoint_list:
-      - url: "{{ magnum_service_publicurl }}"
-        interface: "public"
-      - url: "{{ magnum_service_internalurl }}"
-        interface: "internal"
-      - url: "{{ magnum_service_adminurl }}"
-        interface: "admin"
-  register: add_magnum_endpoints
-  until: add_magnum_endpoints is success
-  retries: 5
-  delay: 2
-  no_log: True
+    - name: Add endpoints to keystone endpoint catalog
+      os_keystone_endpoint:
+        cloud: default
+        state: present
+        service: "{{ magnum_service_name }}"
+        endpoint_interface: "{{ item.interface }}"
+        url: "{{ item.url }}"
+        region: "{{ magnum_service_region }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service_endpoints
+      until: add_service_endpoints is success
+      retries: 5
+      delay: 10
+      with_items:
+        - interface: "public"
+          url: "{{ magnum_service_publicurl }}"
+        - interface: "internal"
+          url: "{{ magnum_service_internalurl }}"
+        - interface: "admin"
+          url: "{{ magnum_service_adminurl }}"
 
-- name: Ensure the magnum trustee domain exists
-  keystone:
-    command: "ensure_domain"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-    domain_name: "{{ magnum_trustee_domain_name }}"
-    domain_enabled: true
-  register: add_magnum_trustee_user
-  until: add_magnum_trustee_user is success
-  retries: 5
-  delay: 2
-  no_log: True
+    - name: Add trustee domain
+      os_keystone_domain:
+        cloud: default
+        state: present
+        name: "{{ magnum_trustee_domain_name }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_trustee_domain
+      until: add_trustee_domain is success
+      retries: 5
+      delay: 10
 
-- name: Ensure the magnum trustee user exists
-  keystone:
-    command: "ensure_user"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-    user_name: "{{ magnum_trustee_domain_admin_name }}"
-    domain_name: "{{ magnum_trustee_domain_name }}"
-    project_name: "{{ magnum_service_project_name }}"
-    password: "{{ magnum_trustee_password |default('changeme') }}"
-  register: add_magnum_trustee_user
-  until: add_magnum_trustee_user is success
-  retries: 5
-  delay: 2
-  no_log: True
+    - name: Add trustee user
+      os_user:
+        cloud: default
+        state: present
+        name: "{{ magnum_trustee_domain_admin_name }}"
+        password: "{{ magnum_trustee_password }}"
+        domain: "{{ magnum_trustee_domain_name }}"
+        default_project: "{{ magnum_service_project_name }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_trustee_user
+      until: add_trustee_user is success
+      retries: 5
+      delay: 10
+      no_log: True
 
-- name: Ensure the magnum user has the admin role
-  keystone:
-    command: "ensure_user_role"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    user_name: "{{ magnum_trustee_domain_admin_name }}"
-    role_name: "{{ item }}"
-    domain_name: "{{ magnum_trustee_domain_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-  register: ensure_magnum_trustee_roles
-  until: ensure_magnum_trustee_roles is success
-  retries: 5
-  delay: 2
-  with_items: "{{ magnum_trustee_domain_admin_roles }}"
-  no_log: True
+    - name: Add trustee user to trustee domain admin roles
+      os_user_role:
+        cloud: default
+        state: present
+        user: "{{ magnum_trustee_domain_admin_name }}"
+        role: "{{ item }}"
+        domain: "{{ add_trustee_domain.id }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_trustee_role
+      until: add_trustee_role is success
+      retries: 5
+      delay: 10
+      with_items: "{{ magnum_trustee_domain_admin_roles }}"
+
+    - name: Create image download directory
+      file:
+        path: "{{ magnum_image_path }}"
+        state: directory
+        mode: "0750"
+        owner: "{{ magnum_image_path_owner }}"
+
+    - name: Download images
+      get_url:
+        url: "{{ item.file }}"
+        dest: "{{ magnum_image_path }}/{{ item.file | basename }}"
+        checksum: "{{ item.checksum | default(omit) }}"
+      register: download_image
+      until: download_image is success
+      retries: 5
+      delay: 10
+      with_items: "{{ magnum_glance_images }}"
+
+    - name: Upload images to Glance
+      os_image:
+        cloud: default
+        state: present
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+        name: "{{ item.name }}"
+        disk_format: "{{ item.disk_format }}"
+        container_format: "{{ item.image_format }}"
+        is_public: "{{ item.public }}"
+        filename: "{{ magnum_image_path }}/{{ item.file | basename }}"
+        properties:
+          os_distro: "{{ item.distro }}"
+      register: upload_image
+      until: upload_image is success
+      retries: 5
+      delay: 10
+      with_items: "{{ magnum_glance_images }}"

tests/test-install-haproxy.yml

@@ -15,6 +15,7 @@
 
 - name: Install haproxy
   hosts: localhost
+  connection: local
   become: true
   roles:
     - role: "haproxy_server"

tests/test-install-magnum.yml

@@ -15,7 +15,7 @@
 
 - name: Install magnum server
   hosts: magnum_all
-  user: root
+  remote_user: root
   vars_files:
     - common/test-vars.yml
   roles: