diff --git a/defaults/main.yml b/defaults/main.yml index 7c32661..a6a7b14 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -16,6 +16,11 @@ ## Verbosity Options debug: False +# Set the host which will execute the shade modules +# for the service setup. The host must already have +# clouds.yaml properly configured. +magnum_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}" + # Set the package install state for distribution and pip packages # Options are 'present' and 'latest' magnum_package_state: "latest" @@ -118,13 +123,11 @@ magnum_glance_images: [] # distro: fedora-atomic #Value for the os_distro metadata # checksum: "sha1:dab00359cfa5cd393f0a6044f77c4a78c6167a47" -magnum_requires_pip_packages: - - httplib2 - - python-glanceclient - - python-keystoneclient - - pyyaml - - shade - - virtualenv +# Set the directory where the downloaded images will be stored +# on the magnum_service_setup_host host. If the host is localhost, +# then the user running the playbook must have access to it. +magnum_image_path: "{{ lookup('env', 'HOME') }}/openstack-ansible/magnum" +magnum_image_path_owner: "{{ lookup('env', 'USER') }}" magnum_pip_packages: - magnum diff --git a/releasenotes/notes/magnum-service-setup-host-ea285f161e625980.yaml b/releasenotes/notes/magnum-service-setup-host-ea285f161e625980.yaml new file mode 100644 index 0000000..b0bb8db --- /dev/null +++ b/releasenotes/notes/magnum-service-setup-host-ea285f161e625980.yaml @@ -0,0 +1,22 @@ +--- +features: + - | + The service setup in keystone for magnum will now be executed + through delegation to the ``magnum_service_setup_host`` which, + by default, is ``localhost`` (the deploy host). Deployers can + opt to rather change this to the utility container by implementing + the following override in ``user_variables.yml``. + + .. code-block:: yaml + + magnum_service_setup_host: "{{ groups['utility_all'][0] }}" + - | + Instead of downloading images to the magnum API servers, the + images will now download to the ``magnum_service_setup_host`` to + the folder set in ``magnum_image_path`` owned by + ``magnum_image_path_owner``. + +deprecations: + - | + The variable ``magnum_requires_pip_packages`` is no longer required + and has therefore been removed. diff --git a/tasks/magnum_install.yml b/tasks/magnum_install.yml index 671a681..6803002 100644 --- a/tasks/magnum_install.yml +++ b/tasks/magnum_install.yml @@ -33,19 +33,6 @@ {% endfor %} when: magnum_developer_mode | bool -- name: Install requires pip packages - pip: - name: "{{ magnum_requires_pip_packages }}" - state: "{{ magnum_pip_package_state }}" - extra_args: >- - {{ magnum_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }} - {{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }} - {{ pip_install_options | default('') }} - register: install_packages - until: install_packages is success - retries: 5 - delay: 2 - - name: Retrieve checksum for venv download uri: url: "{{ magnum_venv_download_url | replace('tgz', 'checksum') }}" diff --git a/tasks/magnum_post_install.yml b/tasks/magnum_post_install.yml index aa81c67..59fe20b 100644 --- a/tasks/magnum_post_install.yml +++ b/tasks/magnum_post_install.yml @@ -37,26 +37,3 @@ config_type: "ini" notify: - Restart magnum services - -- name: Download magnum images - get_url: - url: "{{ item.file }}" - dest: "/var/tmp/{{ item.file | basename }}" - checksum: "{{ item.checksum | default(omit) }}" - with_items: "{{ magnum_glance_images }}" - when: inventory_hostname == groups['magnum_all'][0] - -- name: Upload images to Glance - os_image: - cloud: default - endpoint_type: internal - validate_certs: "{{ keystone_service_internaluri_insecure | ternary(false, true) }}" - name: "{{ item.name }}" - disk_format: "{{ item.disk_format }}" - container_format: "{{ item.image_format }}" - is_public: "{{ item.public }}" - filename: "/var/tmp/{{ item.file | basename }}" - properties: - os_distro: "{{ item.distro }}" - with_items: "{{ magnum_glance_images }}" - when: inventory_hostname == groups['magnum_all'][0] diff --git a/tasks/magnum_service_setup.yml b/tasks/magnum_service_setup.yml index c8e68c1..2ca1e96 100644 --- a/tasks/magnum_service_setup.yml +++ b/tasks/magnum_service_setup.yml @@ -13,130 +13,160 @@ # See the License for the specific language governing permissions and # limitations under the License. -- name: Ensure the service for Magnum exists - keystone: - command: "ensure_service" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - service_name: "{{ magnum_service_name }}" - service_type: "{{ magnum_service_type }}" - description: "{{ magnum_service_description }}" - register: add_magnum_service - until: add_magnum_service is success - retries: 5 - delay: 2 - no_log: True +# We set the python interpreter to the ansible runtime venv if +# the delegation is to localhost so that we get access to the +# appropriate python libraries in that venv. If the delegation +# is to another host, we assume that it is accessible by the +# system python instead. +- name: Setup the service + delegate_to: "{{ magnum_service_setup_host }}" + vars: + ansible_python_interpreter: >- + {{ (magnum_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_python['executable']) }} + block: + - name: Add service to the keystone service catalog + os_keystone_service: + cloud: default + state: present + name: "{{ magnum_service_name }}" + service_type: "{{ magnum_service_type }}" + description: "{{ magnum_service_description }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + until: add_service is success + retries: 5 + delay: 10 -- name: Ensure the magnum user exists - keystone: - command: "ensure_user" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - user_name: "{{ magnum_service_user_name }}" - tenant_name: "{{ magnum_service_project_name }}" - password: "{{ magnum_service_password |default('changeme') }}" - register: add_magnum_user - until: add_magnum_user is success - retries: 5 - delay: 2 - no_log: True + - name: Add service user + os_user: + cloud: default + state: present + name: "{{ magnum_service_user_name }}" + password: "{{ magnum_service_password }}" + domain: default + default_project: "{{ magnum_service_project_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service_user + until: add_service_user is success + retries: 5 + delay: 10 + no_log: True -- name: Ensure the magnum user has the admin role - keystone: - command: "ensure_user_role" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - user_name: "{{ magnum_service_user_name }}" - tenant_name: "{{ magnum_service_project_name }}" - role_name: "{{ item }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: ensure_magnum_roles - until: ensure_magnum_roles is success - retries: 5 - delay: 2 - with_items: "{{ magnum_service_role_names }}" - no_log: True + - name: Add service user to admin roles + os_user_role: + cloud: default + state: present + user: "{{ magnum_service_user_name }}" + role: "{{ item }}" + project: "{{ magnum_service_project_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service_user_role + until: add_service_user_role is success + retries: 5 + delay: 10 + with_items: "{{ magnum_service_role_names }}" -- name: Ensure the magnum endpoint is registered - keystone: - command: "ensure_endpoint" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - region_name: "{{ magnum_service_region }}" - service_name: "{{ magnum_service_name }}" - service_type: "{{ magnum_service_type }}" - endpoint_list: - - url: "{{ magnum_service_publicurl }}" - interface: "public" - - url: "{{ magnum_service_internalurl }}" - interface: "internal" - - url: "{{ magnum_service_adminurl }}" - interface: "admin" - register: add_magnum_endpoints - until: add_magnum_endpoints is success - retries: 5 - delay: 2 - no_log: True + - name: Add endpoints to keystone endpoint catalog + os_keystone_endpoint: + cloud: default + state: present + service: "{{ magnum_service_name }}" + endpoint_interface: "{{ item.interface }}" + url: "{{ item.url }}" + region: "{{ magnum_service_region }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service_endpoints + until: add_service_endpoints is success + retries: 5 + delay: 10 + with_items: + - interface: "public" + url: "{{ magnum_service_publicurl }}" + - interface: "internal" + url: "{{ magnum_service_internalurl }}" + - interface: "admin" + url: "{{ magnum_service_adminurl }}" -- name: Ensure the magnum trustee domain exists - keystone: - command: "ensure_domain" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - domain_name: "{{ magnum_trustee_domain_name }}" - domain_enabled: true - register: add_magnum_trustee_user - until: add_magnum_trustee_user is success - retries: 5 - delay: 2 - no_log: True + - name: Add trustee domain + os_keystone_domain: + cloud: default + state: present + name: "{{ magnum_trustee_domain_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_trustee_domain + until: add_trustee_domain is success + retries: 5 + delay: 10 -- name: Ensure the magnum trustee user exists - keystone: - command: "ensure_user" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - user_name: "{{ magnum_trustee_domain_admin_name }}" - domain_name: "{{ magnum_trustee_domain_name }}" - project_name: "{{ magnum_service_project_name }}" - password: "{{ magnum_trustee_password |default('changeme') }}" - register: add_magnum_trustee_user - until: add_magnum_trustee_user is success - retries: 5 - delay: 2 - no_log: True + - name: Add trustee user + os_user: + cloud: default + state: present + name: "{{ magnum_trustee_domain_admin_name }}" + password: "{{ magnum_trustee_password }}" + domain: "{{ magnum_trustee_domain_name }}" + default_project: "{{ magnum_service_project_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_trustee_user + until: add_trustee_user is success + retries: 5 + delay: 10 + no_log: True -- name: Ensure the magnum user has the admin role - keystone: - command: "ensure_user_role" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - user_name: "{{ magnum_trustee_domain_admin_name }}" - role_name: "{{ item }}" - domain_name: "{{ magnum_trustee_domain_name }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: ensure_magnum_trustee_roles - until: ensure_magnum_trustee_roles is success - retries: 5 - delay: 2 - with_items: "{{ magnum_trustee_domain_admin_roles }}" - no_log: True + - name: Add trustee user to trustee domain admin roles + os_user_role: + cloud: default + state: present + user: "{{ magnum_trustee_domain_admin_name }}" + role: "{{ item }}" + domain: "{{ add_trustee_domain.id }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_trustee_role + until: add_trustee_role is success + retries: 5 + delay: 10 + with_items: "{{ magnum_trustee_domain_admin_roles }}" + + - name: Create image download directory + file: + path: "{{ magnum_image_path }}" + state: directory + mode: "0750" + owner: "{{ magnum_image_path_owner }}" + + - name: Download images + get_url: + url: "{{ item.file }}" + dest: "{{ magnum_image_path }}/{{ item.file | basename }}" + checksum: "{{ item.checksum | default(omit) }}" + register: download_image + until: download_image is success + retries: 5 + delay: 10 + with_items: "{{ magnum_glance_images }}" + + - name: Upload images to Glance + os_image: + cloud: default + state: present + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + name: "{{ item.name }}" + disk_format: "{{ item.disk_format }}" + container_format: "{{ item.image_format }}" + is_public: "{{ item.public }}" + filename: "{{ magnum_image_path }}/{{ item.file | basename }}" + properties: + os_distro: "{{ item.distro }}" + register: upload_image + until: upload_image is success + retries: 5 + delay: 10 + with_items: "{{ magnum_glance_images }}" diff --git a/tests/test-install-haproxy.yml b/tests/test-install-haproxy.yml index 031f22c..ddea3a0 100644 --- a/tests/test-install-haproxy.yml +++ b/tests/test-install-haproxy.yml @@ -15,6 +15,7 @@ - name: Install haproxy hosts: localhost + connection: local become: true roles: - role: "haproxy_server" diff --git a/tests/test-install-magnum.yml b/tests/test-install-magnum.yml index 8536535..2a2bae0 100644 --- a/tests/test-install-magnum.yml +++ b/tests/test-install-magnum.yml @@ -15,7 +15,7 @@ - name: Install magnum server hosts: magnum_all - user: root + remote_user: root vars_files: - common/test-vars.yml roles: