diff --git a/defaults/main.yml b/defaults/main.yml index 34fb4b4e..0b84c03c 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -18,6 +18,11 @@ # Verbosity Options debug: False +# Set the host which will execute the shade modules +# for the service setup. The host must already have +# clouds.yaml properly configured. +ironic_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}" + # Comma separated list of Glance API servers ironic_glance_api_servers: "{{ (glance_service_internalurl | default('http://localhost')) | netorigin }}" @@ -217,11 +222,6 @@ ironic_venv_download_url: http://127.0.0.1/venvs/untagged/ubuntu/ironic.tgz ironic_tftp_server_address: "{{ ansible_host }}" -ironic_requires_pip_packages: - - virtualenv - - python-keystoneclient # Keystoneclient needed for the OSA keystone lib - - httplib2 # for Ansible's uri module - ironic_oneview_optional_pip_packages: - ironic-oneview-cli - ironic-oneviewd diff --git a/meta/main.yml b/meta/main.yml index ccc28325..8b2f4592 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -32,4 +32,3 @@ dependencies: when: - ansible_pkg_mgr == 'apt' - galera_client - - openstack_openrc diff --git a/releasenotes/notes/ironic-service-setup-host-658842e1875ea7bf.yaml b/releasenotes/notes/ironic-service-setup-host-658842e1875ea7bf.yaml new file mode 100644 index 00000000..7f8ed106 --- /dev/null +++ b/releasenotes/notes/ironic-service-setup-host-658842e1875ea7bf.yaml @@ -0,0 +1,17 @@ +--- +features: + - | + The service setup in keystone for ironic will now be executed + through delegation to the ``ironic_service_setup_host`` which, + by default, is ``localhost`` (the deploy host). Deployers can + opt to rather change this to the utility container by implementing + the following override in ``user_variables.yml``. + + .. code-block:: yaml + + ironic_service_setup_host: "{{ groups['utility_all'][0] }}" + +deprecations: + - | + The variable ``ironic_requires_pip_packages`` is no longer required + and has therefore been removed. diff --git a/tasks/ironic_install.yml b/tasks/ironic_install.yml index c1957758..0280d759 100644 --- a/tasks/ironic_install.yml +++ b/tasks/ironic_install.yml @@ -33,19 +33,6 @@ {% endfor %} when: ironic_developer_mode | bool -- name: Install requires pip packages - pip: - name: "{{ ironic_requires_pip_packages }}" - state: "{{ ironic_pip_package_state }}" - extra_args: >- - {{ ironic_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }} - {{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }} - {{ pip_install_options | default('') }} - register: install_packages - until: install_packages|success - retries: 5 - delay: 2 - - name: Retrieve checksum for venv download uri: url: "{{ ironic_venv_download_url | replace('tgz', 'checksum') }}" diff --git a/tasks/ironic_service_setup.yml b/tasks/ironic_service_setup.yml index 5f7f98b4..0321989f 100644 --- a/tasks/ironic_service_setup.yml +++ b/tasks/ironic_service_setup.yml @@ -13,83 +13,81 @@ # See the License for the specific language governing permissions and # limitations under the License. -# Create a service -- name: Ensure ironic service - keystone: - command: "ensure_service" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - endpoint: "{{ keystone_service_adminurl }}" - service_name: "{{ ironic_service_name }}" - service_type: "{{ ironic_service_type }}" - description: "{{ ironic_service_description }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - until: add_service|success - retries: 5 - delay: 2 - no_log: true +# We set the python interpreter to the ansible runtime venv if +# the delegation is to localhost so that we get access to the +# appropriate python libraries in that venv. If the delegation +# is to another host, we assume that it is accessible by the +# system python instead. +- name: Setup the service + delegate_to: "{{ ironic_service_setup_host }}" + vars: + ansible_python_interpreter: >- + {{ (ironic_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_python['executable']) }} + block: + - name: Add service to the keystone service catalog + os_keystone_service: + cloud: default + state: present + name: "{{ ironic_service_name }}" + service_type: "{{ ironic_service_type }}" + description: "{{ ironic_service_description }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + until: add_service is success + retries: 5 + delay: 10 -# Create an admin user -- name: Ensure ironic user - keystone: - command: "ensure_user" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - endpoint: "{{ keystone_service_adminurl }}" - user_name: "{{ ironic_service_user_name }}" - project_name: "{{ ironic_service_project_name }}" - password: "{{ ironic_service_password }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - when: not ironic_service_in_ldap | bool - until: add_service|success - retries: 5 - delay: 10 - no_log: true + - name: Add service user + os_user: + cloud: default + state: present + name: "{{ ironic_service_user_name }}" + password: "{{ ironic_service_password }}" + domain: default + default_project: "{{ ironic_service_project_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + when: not ironic_service_in_ldap | bool + until: add_service is success + retries: 5 + delay: 10 + no_log: True -# Add a role to the user -- name: Ensure ironic user to admin role - keystone: - command: "ensure_user_role" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - endpoint: "{{ keystone_service_adminurl }}" - user_name: "{{ ironic_service_user_name }}" - project_name: "{{ ironic_service_project_name }}" - role_name: "{{ ironic_service_role_name }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - when: not ironic_service_in_ldap | bool - until: add_service|success - retries: 5 - delay: 10 - no_log: true + - name: Add service user to admin role + os_user_role: + cloud: default + state: present + user: "{{ ironic_service_user_name }}" + role: "{{ ironic_service_role_name }}" + project: "{{ ironic_service_project_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + when: not ironic_service_in_ldap | bool + until: add_service is success + retries: 5 + delay: 10 -# Create an endpoint -- name: Ensure ironic endpoint - keystone: - command: "ensure_endpoint" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - endpoint: "{{ keystone_service_adminurl }}" - region_name: "{{ ironic_service_region }}" - service_name: "{{ ironic_service_name }}" - service_type: "{{ ironic_service_type }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - endpoint_list: - - url: "{{ ironic_service_publicurl }}" - interface: "public" - - url: "{{ ironic_service_internalurl }}" - interface: "internal" - - url: "{{ ironic_service_adminurl }}" - interface: "admin" - register: add_service - until: add_service|success - retries: 5 - delay: 10 - no_log: true + - name: Add endpoints to keystone endpoint catalog + os_keystone_endpoint: + cloud: default + state: present + service: "{{ ironic_service_name }}" + endpoint_interface: "{{ item.interface }}" + url: "{{ item.url }}" + region: "{{ ironic_service_region }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + until: add_service is success + retries: 5 + delay: 10 + with_items: + - interface: "public" + url: "{{ ironic_service_publicurl }}" + - interface: "internal" + url: "{{ ironic_service_internalurl }}" + - interface: "admin" + url: "{{ ironic_service_adminurl }}" diff --git a/tests/host_vars/localhost.yml b/tests/host_vars/localhost.yml index cbc442af..017b6cd2 100644 --- a/tests/host_vars/localhost.yml +++ b/tests/host_vars/localhost.yml @@ -14,7 +14,6 @@ # limitations under the License. neutron_local_ip: 10.1.2.1 -ansible_python_interpreter: "/usr/bin/python2" bridges: - name: "br-mgmt" ip_addr: "10.1.1.1" diff --git a/tests/test-configure-ironic.yml b/tests/test-configure-ironic.yml index 2f143f74..f6339ae9 100644 --- a/tests/test-configure-ironic.yml +++ b/tests/test-configure-ironic.yml @@ -15,20 +15,13 @@ - name: Setup localhost requirements hosts: localhost - become: True - gather_facts: True + connection: local + gather_facts: false + vars_files: + - common/test-vars.yml + vars: + ansible_python_interpreter: "{{ ansible_playbook_python }}" tasks: - - name: Install pip requirements - pip: - name: "{{ item }}" - state: "{{ ironic_pip_package_state }}" - with_items: - - python-neutronclient - - shade - register: install_packages - until: install_packages|success - retries: 5 - delay: 2 - name: Create br-prov network os_network: cloud: default @@ -37,6 +30,7 @@ name: "{{ ironic_neutron_provisioning_network_name }}" provider_network_type: flat provider_physical_network: prov + - name: Ensure public subnet exists os_subnet: state: present @@ -46,5 +40,3 @@ network_name: "{{ ironic_neutron_provisioning_network_name }}" name: "ironic-prov-subnet" cidr: "10.1.6.0/24" - vars_files: - - common/test-vars.yml