Use pip_install_options when creating reqt wheels

This prevents pip SSL certificate verification failures in
environments with internally signed certificates by allowing the
certificate location to be specified in the pip_install_options
variable.

The pip_install_options variable is also added to the role defaults.

Change-Id: I447e5378254f88ac4fa87a9db3d34221a21e3685
Partial-Bug: 1621596

defaults/main.yml

@@ -13,6 +13,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# Additional options passed to pip during package installation.
+# A common use is with the '--cert' argument for internally signed
+# SSL certificates.
+pip_install_options: ""
+
 # Set the package install state for distribution packages
 # Options are 'present' and 'latest'
 repo_build_package_state: "latest"

releasenotes/notes/enable_pip_install_options-7c2131c89f90b2c6.yaml

@@ -0,0 +1,6 @@
+---
+fixes:
+  - The pip_install_options variable is now honored during repo
+    building.  This variable allows deployers to specify trusted
+    CA certificates by setting the variable to "--cert
+    /etc/ssl/certs/ca-certificates.crt"

tasks/repo_build.yml

@@ -54,6 +54,7 @@
     --build {{ repo_build_dir }}
     --log /var/log/repo/repo_builder.log
     --requirement {{ repo_build_release_path }}/{{ repo_build_release_tag }}/requirements.txt
+    {{ pip_install_options }}
   tags:
     - repo-build-local-requirement-wheels
     - repo-build-openstack-ansible-requirement-wheels

tasks/repo_pre_build.yml

@@ -74,7 +74,7 @@
   pip:
     name: "{{ repo_pip_packages | join(' ') }}"
     state: latest
-    extra_args: "--constraint {{ repo_build_release_path }}/{{ repo_build_release_tag }}/requirements_constraints.txt {{ pip_install_options|default('') }}"
+    extra_args: "--constraint {{ repo_build_release_path }}/{{ repo_build_release_tag }}/requirements_constraints.txt {{ pip_install_options }}"
   register: install_packages
   until: install_packages|success
   retries: 5