Use RDO/UCA everywhere

The pip_install role installs binary dependencies, like python-openssl
(on Ubuntu), or pyOpenSSL (on Centos).

By default, we didn't configure extra sources (like UCA or RDO)
in the pip_install role. Because the repo is built using UCA or RDO
(current default), we could have inconsistency issues:
containers that haven't UCA or RDO applied during their role execution
would run with a venv packaged for a different python-openssl
(or python-cryptography).

This commit brings the consistency by installing UCA/RDO everywhere.

Closes-Bug: 1624791

Change-Id: I9b5cd40b2972c93af348d4ddfde21a038cf9becc
Signed-off-by: Jean-Philippe Evrard <jean-philippe.evrard@rackspace.co.uk>
(Manually cherry picked from commit
fe4fa18822)

defaults/main.yml

@@ -13,6 +13,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+uca_enable: True
+uca_apt_repo_url: "http://ubuntu-cloud.archive.canonical.com/ubuntu"
+
 # Set the package install state for distribution packages
 # Options are 'present' and 'latest'
 pip_install_package_state: "latest"

releasenotes/notes/use-uca-everywhere-4be33314d01c8545.yaml

@@ -0,0 +1,9 @@
+---
+other:
+  - Ubuntu Cloud Archive (UCA) was installed by default
+    on repo, nova, neutron nodes, but not on the other
+    nodes. From now on, we are using UCA everywhere to
+    avoid dependency issues (like having virtualenv
+    build with incompatible versions of
+    python-cryptography). The same reasoning applies
+    to CentOS and RDO packages.

tasks/pre_install.yml

@@ -13,18 +13,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- name: Install yum packages
-  yum:
-    pkg: "{{ item }}"
-    state: "{{ pip_install_package_state }}"
-  register: install_packages
-  until: install_packages|success
-  retries: 5
-  delay: 2
-  with_items: "{{ pip_install_distro_packages }}"
-  when:
-    - ansible_pkg_mgr == 'yum'
-
 #TODO(evrardjp): Replace the next 2 tasks by a standard apt with cache
 #when https://github.com/ansible/ansible-modules-core/pull/1517 is merged
 #in 1.9.x or we move to 2.0 (if tested working)
@@ -42,14 +30,35 @@
     - ansible_pkg_mgr == 'apt'
     - "ansible_date_time.epoch|float - apt_cache_stat.stat.mtime > {{cache_timeout}}"
 
-- name: Install apt packages
-  apt:
-    pkg: "{{ item }}"
+- name: Install external repo key package
+  package:
+    name: "{{ pip_install_external_repo_key_package }}"
+    state: "{{ pip_install_package_state }}"
+  tags:
+    - add-repo-keys
+
+- name: Install repo for distro binaries
+  apt_repository:
+    repo: "{{ uca_repo }}"
+    state: present
+    update_cache: yes
+    filename: "{{ uca_apt_source_list_filename | default(omit) }}"
+  register: uca_add_repo
+  until: uca_add_repo|success
+  retries: 5
+  delay: 2
+  when:
+    - ansible_pkg_mgr == 'apt'
+    - uca_enable
+  tags:
+    - add-uca-repo
+
+- name: Install packages
+  package:
+    name: "{{ item }}"
     state: "{{ pip_install_package_state }}"
   register: install_packages
   until: install_packages|success
   retries: 5
   delay: 2
   with_items: "{{ pip_install_distro_packages }}"
-  when:
-    - ansible_pkg_mgr == 'apt'

vars/redhat.yml

@@ -13,6 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+pip_install_external_repo_key_package: "centos-release-openstack-newton"
 pip_install_distro_packages:
   - gcc
   - libffi-devel

vars/ubuntu-14.04.yml

@@ -13,6 +13,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# Ubuntu Cloud Archive variables
+uca_openstack_release: mitaka
+uca_repo_dist: "{{ ansible_lsb.codename }}-updates/{{ uca_openstack_release }}"
+uca_repo: "deb {{ uca_apt_repo_url }} {{ uca_repo_dist }} main"
+pip_install_external_repo_key_package: "ubuntu-cloud-keyring"
+
 pip_install_distro_packages:
   - build-essential
   - python-setuptools

vars/ubuntu-16.04.yml

@@ -13,6 +13,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# Ubuntu Cloud Archive variables
+uca_openstack_release: newton
+uca_repo_dist: "{{ ansible_lsb.codename }}-updates/{{ uca_openstack_release }}"
+uca_repo: "deb {{ uca_apt_repo_url }} {{ uca_repo_dist }} main"
+pip_install_external_repo_key_package: "ubuntu-cloud-keyring"
+
 pip_install_distro_packages:
   - build-essential
   - python-dev