Disable glance-registry and the v1 API by default

When using the glance v2 API the glance-registry service is
optional, and the intention is to remove the glance-registry
service in the S cycle.

The glance v1 API is scheduled to be removed in Queens.
This patch therefore disables the v1 API by default to give
us as much time as possible to identify the impact of that
and to get the issues resolved before it is removed from
the code-base.

The patch also cleans up the glance-registry init files
to handle the transition in an existing environment.

Tests are added to validate that enabling the v1 API still
works, and enabling the v2 registry still works.

Change-Id: I4c27aa0ca5b649e4fa76cfd0f326d80f50074db1

defaults/main.yml

@@ -66,9 +66,12 @@ glance_show_multiple_locations: "{{ glance_default_store == 'rbd' }}"
 
 
 ## API options
-glance_enable_v1_api: True
+# The v1 API is deprecated and scheduled for removal in Queens.
+glance_enable_v1_api: False
 glance_enable_v2_api: True
-glance_enable_v2_registry: True
+# The v2 API does not require the registry service.
+# The registry service is scheduled for removal in the S cycle.
+glance_enable_v2_registry: False
 
 ## RabbitMQ info
 

handlers/main.yml

@@ -26,6 +26,56 @@
   delay: 2
   listen: "Restart glance services"
 
+# TODO(odyssey4me):
+# Assuming glance-registry is removed in the S cycle as planned, this
+# task can be removed in the T cycle.
+# Note that this uses shell task because the unit may not exist. When it
+# does not exist, the ansible task which stops/disables it fails and it
+# is important that we see failures, but get failures in the right
+# circumstances.
+- name: Stop and disable glance-registry when it is no longer used
+  shell: |
+    return_code=0
+    if [[ "$(systemctl is-active {{ glance_services['glance-registry']['service_name'] }})" == "active" ]]; then
+      systemctl stop {{ glance_services['glance-registry']['service_name'] }}
+      return_code=2
+    fi
+    if [[ "$(systemctl is-enabled {{ glance_services['glance-registry']['service_name'] }})" == "enabled" ]]; then
+      systemctl disable {{ glance_services['glance-registry']['service_name'] }}
+      return_code=2
+    fi
+    exit ${return_code}
+  args:
+    executable: /bin/bash
+  when:
+    - not glance_services['glance-registry']['condition']
+  register: _remove_glance_service
+  changed_when: _remove_glance_service.rc == 2
+  failed_when: _remove_glance_service.rc not in [0, 2]
+  listen: "Restart glance services"
+  # This task causes ansible-lint to give a ANSIBLE0014
+  # error, which does not make much sense given how the
+  # environment variable is used in this case.
+  # TODO(odyssey4me):
+  # Try to understand the issue ansible-lint is trying
+  # to highlight and address it.
+  tags:
+    - skip_ansible_lint
+
+# TODO(odyssey4me):
+# Assuming glance-registry is removed in the S cycle as planned, this
+# task can be removed in the T cycle.
+- name: Clean up glance-registry init files when they are no longer needed
+  file:
+    path: "{{ item }}"
+    state: absent
+  with_items:
+    - "/etc/tmpfiles.d/openstack-{{ glance_services['glance-registry']['service_name'] }}.conf"
+    - "/etc/systemd/system/{{ glance_services['glance-registry']['service_name'] }}.service"
+  when:
+    - not glance_services['glance-registry']['condition']
+  listen: "Restart glance services"
+
 # Note (odyssey4me):
 # The policy.json file is currently read continually by the services
 # and is not only read on service start. We therefore cannot template

releasenotes/notes/glance-v2-api-only-0d4a61b0d4dade18.yaml

@@ -1,4 +1,13 @@
 ---
+upgrade:
+  - |
+    The glance v1 API is now disabled by default as the API is scheduled
+    to be removed in Queens.
+  - |
+    The glance registry service is now disabled by default as it is not
+    required for the v2 API and is scheduled to be removed in the future.
+    The service can be enabled by setting ``glance_enable_v2_registry``
+    to ``True``.
 deprecations:
   - |
     The ``glance_enable_v1_registry`` variable has been removed. When using

tasks/glance_init_systemd.yml

@@ -31,15 +31,6 @@
     mode: "02755"
   with_items: "{{ filtered_glance_services }}"
 
-# TODO(mgariepy):
-# Remove this in Pike as it only needed to handle upgrades
-# from Newton->Newton and Newton->Ocata
-- name: Cleanup old tmpfiles.d entry
-  file:
-    path: "/etc/tmpfiles.d/{{ item.service_name }}.conf"
-    state: absent
-  with_items: "{{ filtered_glance_services }}"
-
 - name: Create tmpfiles.d entry
   template:
     src: "glance-systemd-tmpfiles.j2"

tests/test-glance-functional.yml

@@ -35,7 +35,7 @@
         url: "http://localhost:9191"
         status_code: 401
       when:
-        - (glance_enable_v1_api | default(True)) | bool or (glance_enable_v2_registry | default(True)) | bool
+        - (glance_enable_v1_api | default(False)) | bool or (glance_enable_v2_registry | default(False)) | bool
 
     - name: Download the Cirros image
       get_url:

tox.ini

@@ -115,12 +115,23 @@ commands =
     bash -c "{toxinidir}/tests/test-glance-upgrades.sh"
 
 
-[testenv:v2_api_only]
+[testenv:v1_api_enabled]
 deps =
     {[testenv:ansible]deps}
 setenv =
     {[testenv]setenv}
-    ANSIBLE_PARAMETERS=-e glance_enable_v1_api=False -e glance_enable_v2_registry=False
+    ANSIBLE_PARAMETERS=-e glance_enable_v1_api=True
+commands =
+    bash -c "{toxinidir}/tests/tests-repo-clone.sh"
+    bash -c "{toxinidir}/tests/common/test-ansible-functional.sh"
+
+
+[testenv:v2_registry_enabled]
+deps =
+    {[testenv:ansible]deps}
+setenv =
+    {[testenv]setenv}
+    ANSIBLE_PARAMETERS=-e glance_enable_v2_registry=True
 commands =
     bash -c "{toxinidir}/tests/tests-repo-clone.sh"
     bash -c "{toxinidir}/tests/common/test-ansible-functional.sh"

zuul.d/jobs.yaml

@@ -14,8 +14,15 @@
 # limitations under the License.
 
 - job:
-    name: openstack-ansible-v2_api_only
+    name: openstack-ansible-v1_api_enabled
     parent: openstack-ansible-functional
     nodeset: ubuntu-xenial
     vars:
-      tox_env: v2_api_only
+      tox_env: v1_api_enabled
+
+- job:
+    name: openstack-ansible-v2_registry_enabled
+    parent: openstack-ansible-functional
+    nodeset: ubuntu-xenial
+    vars:
+      tox_env: v2_registry_enabled

zuul.d/project.yaml

@@ -22,7 +22,8 @@
         - openstack-ansible-functional-opensuse-423
         - openstack-ansible-functional-ubuntu-xenial
         - openstack-ansible-upgrade-ubuntu-xenial
-        - openstack-ansible-v2_api_only
+        - openstack-ansible-v1_api_enabled
+        - openstack-ansible-v2_registry_enabled
     gate:
       jobs:
         - openstack-ansible-linters
@@ -30,4 +31,6 @@
         - openstack-ansible-functional-opensuse-423
         - openstack-ansible-functional-ubuntu-xenial
         - openstack-ansible-upgrade-ubuntu-xenial
-        - openstack-ansible-v2_api_only
+        - openstack-ansible-v1_api_enabled
+        - openstack-ansible-v2_registry_enabled
+