Use upper-constraints everywhere in ironic installation

Currently a few packages are installed without it, pulling in undesired
updates (e.g. cryptography 2.8 on stable/steain). This change fixes it.

The --upgrade and --force-reinstall flags are removed from all pip calls
since they're not compatible with using upper-constraints.

The explicit installation of pyOpenSSL is removed, >= 18.0 is anyway
used by Rocky and newer. A few explicit usages of -c argument are
also removed in favour of the implicit handling in pip_install.yml.

Change-Id: Ic776cb2ec0779c9b324e94bf387ee4f3f857cd72

playbooks/roles/bifrost-ironic-install/defaults/main.yml

@@ -304,9 +304,7 @@ ironic_inspector:
     # DEPRECATED(TheJulia): Inheritance of ironic_db_password params
     # should be removed in Queens.
 
-# NOTE(hwoarang): openSUSE distros may come with recent pip versions so
-# upgrade only what's necessary
-pip_opts: "{{ ((ansible_os_family | lower == 'suse') or (enable_venv | bool)) | ternary('--upgrade-strategy only-if-needed', '--force-reinstall') }}"
+pip_opts: "--upgrade-strategy only-if-needed"
 
 # Timeout for gathering facts.
 fact_gather_timeout: "{{ lookup('config', 'DEFAULT_GATHER_TIMEOUT', on_missing='skip') | default(omit, true) }}"

playbooks/roles/bifrost-ironic-install/tasks/inspector_install.yml

@@ -19,7 +19,7 @@
     state=latest
     sourcedir={{ ironicinspector_git_folder }}
     source_install={{ ironicinspector_source_install }}
-    extra_args="--no-cache-dir --upgrade {{ pip_opts }} -c {{ upper_constraints_file }}"
+    extra_args="--no-cache-dir {{ pip_opts }}"
 
 - name: "Inspector - PIP client install"
   include: pip_install.yml
@@ -27,4 +27,4 @@
     state=latest
     sourcedir={{ ironicinspectorclient_git_folder }}
     source_install={{ ironicinspectorclient_source_install }}
-    extra_args="--no-cache-dir --upgrade {{ pip_opts }} -c {{ upper_constraints_file }}"
+    extra_args="--no-cache-dir {{ pip_opts }}"

playbooks/roles/bifrost-ironic-install/tasks/install.yml

@@ -115,7 +115,7 @@
     state=latest
     sourcedir={{ ironic_git_folder }}
     source_install=true
-    extra_args="--no-cache-dir --upgrade {{ pip_opts }}"
+    extra_args="--no-cache-dir {{ pip_opts }}"
   when: skip_install is not defined
 
 - name: "Install ironic-inspector to permit use of inspection interface"
@@ -129,24 +129,16 @@
 # NOTE(pas-ha) even when install into virtualenv is requested,
 # we need to install shade into system for enroll-dynamic to succeed
 - block:
-  - name: install pyOpenSSL>18.0.0 from PyPI
-    command: "pip3 install pyOpenSSL>=18.0.0"
-  - name: install shade from PyPI
-    command: "pip3 install shade"
-    when: shade_source_install | default(false) | bool == false
-  - name: install shade from source
-    command: "pip3 install {{ shade_git_folder }}"
-    when: shade_source_install | default(false) | bool == true
+  - name: install shade
+    include: pip_install.yml
+      package=shade
+      sourcedir={{ shade_git_folder }}
+      source_install={{ shade_source_install }}
+  # NOTE(TheJulia): Install openstacksdk since shade wraps to openstacksdk and
+  # the logic is largely going into openstacksdk as time goes on.
+  - name: install openstacksdk
+    include: pip_install.yml
+      package=openstacksdk
+      sourcedir={{ openstacksdk_git_folder }}
+      source_install={{ openstacksdk_source_install }}
   when: skip_install is not defined
-
-# NOTE(TheJulia): Install openstacksdk since shade wraps to openstacksdk and the
-# logic is largely going into openstacksdk as time goes on.
-- block:
-  - name: install openstacksdk from PyPI
-    command: "pip3 install openstacksdk"
-    when: openstacksdk_source_install | default(false) | bool == false
-  - name: install openstacksdk from source
-    command: "pip3 install {{ openstacksdk_git_folder }}"
-    when: openstacksdk_source_install | default(false) | bool == true
-  when: skip_install is not defined
-

playbooks/roles/bifrost-ironic-install/tasks/staging_install.yml

@@ -19,4 +19,4 @@
     state=latest
     sourcedir={{ staging_drivers_git_folder }}
     source_install={{ staging_drivers_source_install }}
-    extra_args="--no-cache-dir --upgrade --upgrade-strategy only-if-needed -c {{ upper_constraints_file }}"
+    extra_args="--no-cache-dir --upgrade-strategy only-if-needed"

playbooks/roles/bifrost-keystone-install/defaults/main.yml

@@ -61,6 +61,4 @@ keystone:
     password: ChangeThisPa55w0rd
     host: localhost
 
-# NOTE(hwoarang): openSUSE distros may come with recent pip versions so
-# upgrade only what's necessary
-pip_opts: "{{ ((ansible_os_family | lower == 'suse') or (enable_venv | bool)) | ternary('--upgrade-strategy only-if-needed', '--force-reinstall') }}"
+pip_opts: "--upgrade-strategy only-if-needed"

playbooks/roles/bifrost-keystone-install/tasks/install.yml

@@ -63,7 +63,7 @@
     state=latest
     sourcedir={{ keystone_git_folder }}
     source_install={{ keystone_source_install | bool }}
-    extra_args="--no-cache-dir --upgrade {{ pip_opts }} -c {{ upper_constraints_file }}"
+    extra_args="--no-cache-dir {{ pip_opts }} -c {{ upper_constraints_file }}"
   when:
     - skip_install is not defined
     - enable_venv | bool == true
@@ -98,7 +98,7 @@
     state=latest
     sourcedir={{ keystone_git_folder }}
     source_install={{ keystone_source_install | bool }}
-    extra_args="--no-cache-dir --upgrade {{ pip_opts }} -c {{ upper_constraints_file }}"
+    extra_args="--no-cache-dir {{ pip_opts }} -c {{ upper_constraints_file }}"
   when:
     - skip_install is not defined
     - enable_venv | bool == false