Create flag to enable/disable creation of resource agents

This is useful in case we want the resource agent creation to be
handled elsewhere, either by another configuration management tool,
or in another step of the deployment.

README.md

@@ -36,6 +36,8 @@ Role Variables
 * `ipsec_upgrade_tunnels`: Determines whether the role should upgrade the IPSEC
   tunnels that were previously set. This means it'll remove all the tunnels
   created in a previous run and replace them. Defaults to: `false`.
+* `ipsec_setup_resource_agents`: Determines whether the role should create the
+  pacemaker resource agents or not. Defaults to: `true`.
 * `ipsec_force_install_legacy`: Forces the legacy installation. Defaults to: `false`.
 * `overcloud_controller_identifier`: This identifies which nodes are
   controllers in the cluster and which aren't, and should be part of the

defaults/main.yml

@@ -3,6 +3,7 @@ overcloud_controller_identifier: controller
 ipsec_algorithm: 'aes_gcm128-null'
 ipsec_skip_firewall_rules: false
 ipsec_uninstall_tunnels: false
+ipsec_setup_resource_agents: true
 ipsec_force_install_legacy: false
 ipsec_upgrade_tunnels: false
 use_opportunistic_ipsec: false

tasks/ipsec-conf.yml

@@ -100,3 +100,4 @@
     - type != 'opportunistic'
     - current_vip.ip != ''
     - inventory_hostname == groups['pacemaker'][0]
+    - ipsec_setup_resource_agents|bool