Properly constrain magnum dependencies

The magnum source repository unfortunately is not
adhering to the global requirements management process
in that it has requirements specified in the repo which
are not in the global requirements repo.

As a result of the requirement being missing, those
requirements are not constrained by upper-constraints.
That, in turn, causes the repo build to fail to build
the magnum venv due to incompatible requirements.

Given that Ocata is a bit old and we're unlikely to be
able to change the project's behaviour, we implement
our own pins in the repo for the extra dependencies
(both direct and indirect).

The pins we set here are based on the upper-constraints
for pike which do no conflict with the rest of the ocata
libraries.

Change-Id: I987cfd2f1fa2be967c4cd86a00f9071915e25973

defaults/main.yml

@@ -116,6 +116,8 @@ magnum_pip_packages:
   - magnum
   - python-memcached
   - osprofiler
+  - kubernetes==2.0.0
+  - certifi==2017.4.17
 
 # This variable is used by the repo_build process to determine
 # which host group to check for members of before building the

releasenotes/notes/kubernetes-pin-56768037d47ebc73.yaml

@@ -0,0 +1,13 @@
+---
+issues:
+  - |
+    For all ocata releases prior to OpenStack-Ansible 15.1.16,
+    several of the magnum requirements were not constrained.
+    This resulted in the kubernetes version changing over time
+    unexpectedly, rather than by intention. Most recently this
+    lack of constraint causes the repo build to fail when trying
+    to build the magnum venv due to incompatible requirements.
+
+    The kubernetes version deployed with ocata is now constrained
+    to version 2.0.0, matching the same version as deployed in
+    all pike releases.