Merge "Execute service setup against a delegated host using Ansible built-in modules"

defaults/main.yml

@@ -16,6 +16,11 @@
 ## Verbosity Options
 debug: False
 
+# Set the host which will execute the shade modules
+# for the service setup. The host must already have
+# clouds.yaml properly configured.
+magnum_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}"
+
 # Set the package install state for distribution and pip packages
 # Options are 'present' and 'latest'
 magnum_package_state: "latest"
@@ -118,13 +123,11 @@ magnum_glance_images: []
 #    distro: fedora-atomic              #Value for the os_distro metadata
 #    checksum: "sha1:dab00359cfa5cd393f0a6044f77c4a78c6167a47"
 
-magnum_requires_pip_packages:
-  - httplib2
-  - python-glanceclient
-  - python-keystoneclient
-  - pyyaml
-  - shade
-  - virtualenv
+# Set the directory where the downloaded images will be stored
+# on the magnum_service_setup_host host. If the host is localhost,
+# then the user running the playbook must have access to it.
+magnum_image_path: "{{ lookup('env', 'HOME') }}/openstack-ansible/magnum"
+magnum_image_path_owner: "{{ lookup('env', 'USER') }}"
 
 magnum_pip_packages:
   - magnum

releasenotes/notes/magnum-service-setup-host-ea285f161e625980.yaml

@@ -0,0 +1,22 @@
+---
+features:
+  - |
+    The service setup in keystone for magnum will now be executed
+    through delegation to the ``magnum_service_setup_host`` which,
+    by default, is ``localhost`` (the deploy host). Deployers can
+    opt to rather change this to the utility container by implementing
+    the following override in ``user_variables.yml``.
+
+    .. code-block:: yaml
+
+      magnum_service_setup_host: "{{ groups['utility_all'][0] }}"
+  - |
+    Instead of downloading images to the magnum API servers, the
+    images will now download to the ``magnum_service_setup_host`` to
+    the folder set in ``magnum_image_path`` owned by
+    ``magnum_image_path_owner``.
+
+deprecations:
+  - |
+    The variable ``magnum_requires_pip_packages`` is no longer required
+    and has therefore been removed.

tasks/magnum_install.yml

@@ -33,19 +33,6 @@
       {% endfor %}
   when: magnum_developer_mode | bool
 
-- name: Install requires pip packages
-  pip:
-    name: "{{ magnum_requires_pip_packages }}"
-    state: "{{ magnum_pip_package_state }}"
-    extra_args: >-
-      {{ magnum_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }}
-      {{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }}
-      {{ pip_install_options | default('') }}
-  register: install_packages
-  until: install_packages is success
-  retries: 5
-  delay: 2
-
 - name: Retrieve checksum for venv download
   uri:
     url: "{{ magnum_venv_download_url | replace('tgz', 'checksum') }}"

tasks/magnum_post_install.yml

@@ -37,26 +37,3 @@
       config_type: "ini"
   notify:
     - Restart magnum services
-
-- name: Download magnum images
-  get_url:
-    url: "{{ item.file }}"
-    dest: "/var/tmp/{{ item.file | basename }}"
-    checksum: "{{ item.checksum | default(omit) }}"
-  with_items: "{{ magnum_glance_images }}"
-  when: inventory_hostname == groups['magnum_all'][0]
-
-- name: Upload images to Glance
-  os_image:
-    cloud: default
-    endpoint_type: internal
-    validate_certs: "{{ keystone_service_internaluri_insecure | ternary(false, true) }}"
-    name: "{{ item.name }}"
-    disk_format: "{{ item.disk_format }}"
-    container_format: "{{ item.image_format }}"
-    is_public: "{{ item.public }}"
-    filename: "/var/tmp/{{ item.file | basename }}"
-    properties:
-      os_distro: "{{ item.distro }}"
-  with_items: "{{ magnum_glance_images }}"
-  when: inventory_hostname == groups['magnum_all'][0]

tasks/magnum_service_setup.yml

@@ -13,130 +13,160 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- name: Ensure the service for Magnum exists
-  keystone:
-    command: "ensure_service"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-    service_name: "{{ magnum_service_name }}"
-    service_type: "{{ magnum_service_type }}"
-    description: "{{ magnum_service_description }}"
-  register: add_magnum_service
-  until: add_magnum_service is success
-  retries: 5
-  delay: 2
-  no_log: True
+# We set the python interpreter to the ansible runtime venv if
+# the delegation is to localhost so that we get access to the
+# appropriate python libraries in that venv. If the delegation
+# is to another host, we assume that it is accessible by the
+# system python instead.
+- name: Setup the service
+  delegate_to: "{{ magnum_service_setup_host }}"
+  vars:
+    ansible_python_interpreter: >-
+      {{ (magnum_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_python['executable']) }}
+  block:
+    - name: Add service to the keystone service catalog
+      os_keystone_service:
+        cloud: default
+        state: present
+        name: "{{ magnum_service_name }}"
+        service_type: "{{ magnum_service_type }}"
+        description: "{{ magnum_service_description }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service
+      until: add_service is success
+      retries: 5
+      delay: 10
 
-- name: Ensure the magnum user exists
-  keystone:
-    command: "ensure_user"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-    user_name: "{{ magnum_service_user_name }}"
-    tenant_name: "{{ magnum_service_project_name }}"
-    password: "{{ magnum_service_password |default('changeme') }}"
-  register: add_magnum_user
-  until: add_magnum_user is success
-  retries: 5
-  delay: 2
-  no_log: True
+    - name: Add service user
+      os_user:
+        cloud: default
+        state: present
+        name: "{{ magnum_service_user_name }}"
+        password: "{{ magnum_service_password }}"
+        domain: default
+        default_project: "{{ magnum_service_project_name }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service_user
+      until: add_service_user is success
+      retries: 5
+      delay: 10
+      no_log: True
 
-- name: Ensure the magnum user has the admin role
-  keystone:
-    command: "ensure_user_role"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    user_name: "{{ magnum_service_user_name }}"
-    tenant_name: "{{ magnum_service_project_name }}"
-    role_name: "{{ item }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-  register: ensure_magnum_roles
-  until: ensure_magnum_roles is success
-  retries: 5
-  delay: 2
-  with_items: "{{ magnum_service_role_names }}"
-  no_log: True
+    - name: Add service user to admin roles
+      os_user_role:
+        cloud: default
+        state: present
+        user: "{{ magnum_service_user_name }}"
+        role: "{{ item }}"
+        project: "{{ magnum_service_project_name }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service_user_role
+      until: add_service_user_role is success
+      retries: 5
+      delay: 10
+      with_items: "{{ magnum_service_role_names }}"
 
-- name: Ensure the magnum endpoint is registered
-  keystone:
-    command: "ensure_endpoint"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-    region_name: "{{ magnum_service_region }}"
-    service_name: "{{ magnum_service_name }}"
-    service_type: "{{ magnum_service_type }}"
-    endpoint_list:
-      - url: "{{ magnum_service_publicurl }}"
-        interface: "public"
-      - url: "{{ magnum_service_internalurl }}"
-        interface: "internal"
-      - url: "{{ magnum_service_adminurl }}"
-        interface: "admin"
-  register: add_magnum_endpoints
-  until: add_magnum_endpoints is success
-  retries: 5
-  delay: 2
-  no_log: True
+    - name: Add endpoints to keystone endpoint catalog
+      os_keystone_endpoint:
+        cloud: default
+        state: present
+        service: "{{ magnum_service_name }}"
+        endpoint_interface: "{{ item.interface }}"
+        url: "{{ item.url }}"
+        region: "{{ magnum_service_region }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service_endpoints
+      until: add_service_endpoints is success
+      retries: 5
+      delay: 10
+      with_items:
+        - interface: "public"
+          url: "{{ magnum_service_publicurl }}"
+        - interface: "internal"
+          url: "{{ magnum_service_internalurl }}"
+        - interface: "admin"
+          url: "{{ magnum_service_adminurl }}"
 
-- name: Ensure the magnum trustee domain exists
-  keystone:
-    command: "ensure_domain"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-    domain_name: "{{ magnum_trustee_domain_name }}"
-    domain_enabled: true
-  register: add_magnum_trustee_user
-  until: add_magnum_trustee_user is success
-  retries: 5
-  delay: 2
-  no_log: True
+    - name: Add trustee domain
+      os_keystone_domain:
+        cloud: default
+        state: present
+        name: "{{ magnum_trustee_domain_name }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_trustee_domain
+      until: add_trustee_domain is success
+      retries: 5
+      delay: 10
 
-- name: Ensure the magnum trustee user exists
-  keystone:
-    command: "ensure_user"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-    user_name: "{{ magnum_trustee_domain_admin_name }}"
-    domain_name: "{{ magnum_trustee_domain_name }}"
-    project_name: "{{ magnum_service_project_name }}"
-    password: "{{ magnum_trustee_password |default('changeme') }}"
-  register: add_magnum_trustee_user
-  until: add_magnum_trustee_user is success
-  retries: 5
-  delay: 2
-  no_log: True
+    - name: Add trustee user
+      os_user:
+        cloud: default
+        state: present
+        name: "{{ magnum_trustee_domain_admin_name }}"
+        password: "{{ magnum_trustee_password }}"
+        domain: "{{ magnum_trustee_domain_name }}"
+        default_project: "{{ magnum_service_project_name }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_trustee_user
+      until: add_trustee_user is success
+      retries: 5
+      delay: 10
+      no_log: True
 
-- name: Ensure the magnum user has the admin role
-  keystone:
-    command: "ensure_user_role"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    user_name: "{{ magnum_trustee_domain_admin_name }}"
-    role_name: "{{ item }}"
-    domain_name: "{{ magnum_trustee_domain_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-  register: ensure_magnum_trustee_roles
-  until: ensure_magnum_trustee_roles is success
-  retries: 5
-  delay: 2
-  with_items: "{{ magnum_trustee_domain_admin_roles }}"
-  no_log: True
+    - name: Add trustee user to trustee domain admin roles
+      os_user_role:
+        cloud: default
+        state: present
+        user: "{{ magnum_trustee_domain_admin_name }}"
+        role: "{{ item }}"
+        domain: "{{ add_trustee_domain.id }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_trustee_role
+      until: add_trustee_role is success
+      retries: 5
+      delay: 10
+      with_items: "{{ magnum_trustee_domain_admin_roles }}"
+
+    - name: Create image download directory
+      file:
+        path: "{{ magnum_image_path }}"
+        state: directory
+        mode: "0750"
+        owner: "{{ magnum_image_path_owner }}"
+
+    - name: Download images
+      get_url:
+        url: "{{ item.file }}"
+        dest: "{{ magnum_image_path }}/{{ item.file | basename }}"
+        checksum: "{{ item.checksum | default(omit) }}"
+      register: download_image
+      until: download_image is success
+      retries: 5
+      delay: 10
+      with_items: "{{ magnum_glance_images }}"
+
+    - name: Upload images to Glance
+      os_image:
+        cloud: default
+        state: present
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+        name: "{{ item.name }}"
+        disk_format: "{{ item.disk_format }}"
+        container_format: "{{ item.image_format }}"
+        is_public: "{{ item.public }}"
+        filename: "{{ magnum_image_path }}/{{ item.file | basename }}"
+        properties:
+          os_distro: "{{ item.distro }}"
+      register: upload_image
+      until: upload_image is success
+      retries: 5
+      delay: 10
+      with_items: "{{ magnum_glance_images }}"

tests/test-install-haproxy.yml

@@ -15,6 +15,7 @@
 
 - name: Install haproxy
   hosts: localhost
+  connection: local
   become: true
   roles:
     - role: "haproxy_server"

tests/test-install-magnum.yml

@@ -15,7 +15,7 @@
 
 - name: Install magnum server
   hosts: magnum_all
-  user: root
+  remote_user: root
   vars_files:
     - common/test-vars.yml
   roles: