From fa11f38215b103dfbbb1703af43e53a8c7fb681e Mon Sep 17 00:00:00 2001 From: Jesse Pretorius Date: Sun, 13 May 2018 20:31:47 +0100 Subject: [PATCH] Execute service setup against a delegated host using Ansible built-in modules In order to reduce the packages required to pip install on to the hosts, we allow the service setup to be delegated to a specific host, defaulting to the deploy host. We also switch as many tasks as possible to using the built-in Ansible modules which make use of the shade library. The 'virtualenv' package is now installed appropriately by the openstack_hosts role, so there's no need to install it any more. The 'httplib2' package is a legacy Ansible requirement for the get_url/get_uri module which is no longer needed. As there are no required packages left, the task to install them is also removed. With the dependent patches, the openstack_openrc role is now executed once on the designated host, so it is no longer required as a meta-dependency for the role. Ansible 2.5 is a hard dependency for this patch due to the dynamic setting of the ansible_python_interpreter, which in 2.4 is literally interpreted, but in 2.5 thanks to [1] is now templated. See [2] for more details. [1] https://github.com/ansible/ansible/pull/33698 [2] https://github.com/ansible/ansible/issues/18665 Depends-On: https://review.openstack.org/501814 Depends-On: https://review.openstack.org/568139 Depends-On: https://review.openstack.org/568141 Depends-On: https://review.openstack.org/568146 Depends-On: https://review.openstack.org/571423 Depends-On: https://review.openstack.org/579233 Depends-On: https://review.openstack.org/579959 Depends-On: https://review.openstack.org/580156 Change-Id: I6a5a85fae5a481900149a343a163fe82e788d1eb --- defaults/main.yml | 11 +- meta/main.yml | 1 - ...e-service-setup-host-b0e71be408de074b.yaml | 17 ++ tasks/glance_install_source.yml | 13 -- tasks/glance_service_setup.yml | 152 +++++++++--------- tests/host_vars/localhost.yml | 2 - 6 files changed, 97 insertions(+), 99 deletions(-) create mode 100644 releasenotes/notes/glance-service-setup-host-b0e71be408de074b.yaml diff --git a/defaults/main.yml b/defaults/main.yml index 46b6f459..e2931c75 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -19,6 +19,11 @@ debug: False # Set installation method glance_install_method: "source" +# Set the host which will execute the shade modules +# for the service setup. The host must already have +# clouds.yaml properly configured. +glance_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}" + # Set the package install state for distribution and pip packages # Options are 'present' and 'latest' glance_package_state: "latest" @@ -225,12 +230,6 @@ glance_rbd_store_chunk_size: 8 glance_service_in_ldap: false - -# Cinder packages that must be installed before anything else -glance_requires_pip_packages: - - virtualenv - - httplib2 - # Common pip packages glance_pip_packages: - cryptography diff --git a/meta/main.yml b/meta/main.yml index d313b104..fe4282f1 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -42,4 +42,3 @@ dependencies: when: - ansible_pkg_mgr == 'apt' - galera_client - - openstack_openrc diff --git a/releasenotes/notes/glance-service-setup-host-b0e71be408de074b.yaml b/releasenotes/notes/glance-service-setup-host-b0e71be408de074b.yaml new file mode 100644 index 00000000..49540abe --- /dev/null +++ b/releasenotes/notes/glance-service-setup-host-b0e71be408de074b.yaml @@ -0,0 +1,17 @@ +--- +features: + - | + The service setup in keystone for glance will now be executed + through delegation to the ``glance_service_setup_host`` which, + by default, is ``localhost`` (the deploy host). Deployers can + opt to rather change this to the utility container by implementing + the following override in ``user_variables.yml``. + + .. code-block:: yaml + + glance_service_setup_host: "{{ groups['utility_all'][0] }}" + +deprecations: + - | + The variable ``glance_requires_pip_packages`` is no longer required + and has therefore been removed. diff --git a/tasks/glance_install_source.yml b/tasks/glance_install_source.yml index 28470520..6b99dded 100644 --- a/tasks/glance_install_source.yml +++ b/tasks/glance_install_source.yml @@ -22,19 +22,6 @@ {% endfor %} when: glance_developer_mode | bool -- name: Install requires pip packages - pip: - name: "{{ glance_requires_pip_packages }}" - state: "{{ glance_pip_package_state }}" - extra_args: >- - {{ glance_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }} - {{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }} - {{ pip_install_options | default('') }} - register: install_packages - until: install_packages|success - retries: 5 - delay: 2 - - name: Retrieve checksum for venv download uri: url: "{{ glance_venv_download_url | replace('tgz', 'checksum') }}" diff --git a/tasks/glance_service_setup.yml b/tasks/glance_service_setup.yml index 4ad6074e..3f2ac82e 100644 --- a/tasks/glance_service_setup.yml +++ b/tasks/glance_service_setup.yml @@ -13,83 +13,81 @@ # See the License for the specific language governing permissions and # limitations under the License. -# Create a service -- name: Ensure glance service - keystone: - command: "ensure_service" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - service_name: "{{ glance_service_name }}" - service_type: "{{ glance_service_type }}" - description: "{{ glance_service_description }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - until: add_service|success - retries: 5 - delay: 2 - no_log: True +# We set the python interpreter to the ansible runtime venv if +# the delegation is to localhost so that we get access to the +# appropriate python libraries in that venv. If the delegation +# is to another host, we assume that it is accessible by the +# system python instead. +- name: Setup the service + delegate_to: "{{ glance_service_setup_host }}" + vars: + ansible_python_interpreter: >- + {{ (glance_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_python['executable']) }} + block: + - name: Add service to the keystone service catalog + os_keystone_service: + cloud: default + state: present + name: "{{ glance_service_name }}" + service_type: "{{ glance_service_type }}" + description: "{{ glance_service_description }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + until: add_service is success + retries: 5 + delay: 10 -# Create an admin user -- name: Ensure glance user - keystone: - command: "ensure_user" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - user_name: "{{ glance_service_user_name }}" - tenant_name: "{{ glance_service_project_name }}" - password: "{{ glance_service_password }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - when: not glance_service_in_ldap | bool - until: add_service|success - retries: 5 - delay: 10 - no_log: True + - name: Add service user + os_user: + cloud: default + state: present + name: "{{ glance_service_user_name }}" + password: "{{ glance_service_password }}" + domain: default + default_project: "{{ glance_service_project_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + when: not glance_service_in_ldap | bool + until: add_service is success + retries: 5 + delay: 10 + no_log: True -# Add a role to the user -- name: Ensure glance user to admin role - keystone: - command: "ensure_user_role" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - user_name: "{{ glance_service_user_name }}" - tenant_name: "{{ glance_service_project_name }}" - role_name: "{{ glance_role_name }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - when: not glance_service_in_ldap | bool - until: add_service|success - retries: 5 - delay: 10 - no_log: True + - name: Add service user to admin role + os_user_role: + cloud: default + state: present + user: "{{ glance_service_user_name }}" + role: "{{ glance_role_name }}" + project: "{{ glance_service_project_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + when: not glance_service_in_ldap | bool + until: add_service is success + retries: 5 + delay: 10 -# Create an endpoint -- name: Ensure glance endpoint - keystone: - command: "ensure_endpoint" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - region_name: "{{ glance_service_region }}" - service_name: "{{ glance_service_name }}" - service_type: "{{ glance_service_type }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - endpoint_list: - - url: "{{ glance_service_publicurl }}" - interface: "public" - - url: "{{ glance_service_internalurl }}" - interface: "internal" - - url: "{{ glance_service_adminurl }}" - interface: "admin" - register: add_service - until: add_service|success - retries: 5 - delay: 10 - no_log: True + - name: Add endpoints to keystone endpoint catalog + os_keystone_endpoint: + cloud: default + state: present + service: "{{ glance_service_name }}" + endpoint_interface: "{{ item.interface }}" + url: "{{ item.url }}" + region: "{{ glance_service_region }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + until: add_service is success + retries: 5 + delay: 10 + with_items: + - interface: "public" + url: "{{ glance_service_publicurl }}" + - interface: "internal" + url: "{{ glance_service_internalurl }}" + - interface: "admin" + url: "{{ glance_service_adminurl }}" diff --git a/tests/host_vars/localhost.yml b/tests/host_vars/localhost.yml index f7fc7d66..dcb754aa 100644 --- a/tests/host_vars/localhost.yml +++ b/tests/host_vars/localhost.yml @@ -16,5 +16,3 @@ bridges: - name: "br-mgmt" ip_addr: "10.1.0.1" - -ansible_python_interpreter: "/usr/bin/python2"