From 9451adb165aca6face333f12c6b94975ae02b00b Mon Sep 17 00:00:00 2001 From: Jesse Pretorius Date: Mon, 2 Jul 2018 11:00:21 +0100 Subject: [PATCH] Execute service setup against a delegated host using Ansible built-in modules In order to reduce the packages required to pip install on to the hosts, we allow the service setup to be delegated to a specific host, defaulting to the deploy host. We also switch as many tasks as possible to using the built-in Ansible modules which make use of the shade library. The openstack_openrc role is now executed once on the designated host, so it is no longer necessary to execute it using include_role here. The zun_requires_pip_packages variable is not used and is therefore removed. Depends-On: https://review.openstack.org/579233 Depends-On: https://review.openstack.org/579959 Change-Id: I7108b43109136aac46bc87a0c59827a202f87be8 --- defaults/main.yml | 6 +- tasks/zun_install.yml | 13 -- tasks/zun_service_setup.yml | 229 +++++++++++++--------------------- tests/host_vars/localhost.yml | 1 - tests/test-install-zun.yml | 2 +- 5 files changed, 91 insertions(+), 160 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 0812e2c..3568977 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -26,6 +26,11 @@ zun_ceilometer_enabled: False ## Verbosity Options debug: False +# Set the host which will execute the shade modules +# for the service setup. The host must already have +# clouds.yaml properly configured. +zun_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}" + # Set the package install state for distribution and pip packages # Options are 'present' and 'latest' zun_package_state: "latest" @@ -224,7 +229,6 @@ zun_services: execstarts: "{{ zun_bin }}/zun-wsproxy --config-dir /etc/zun" # Common pip packages -zun_requires_pip_packages: [] zun_pip_packages: - kuryr-libnetwork - oslo_rootwrap diff --git a/tasks/zun_install.yml b/tasks/zun_install.yml index 103a320..81c7214 100644 --- a/tasks/zun_install.yml +++ b/tasks/zun_install.yml @@ -30,19 +30,6 @@ when: - zun_developer_mode | bool -- name: Install required pip packages - pip: - name: "{{ zun_requires_pip_packages }}" - state: "{{ zun_pip_package_state }}" - extra_args: >- - {{ zun_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }} - {{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }} - {{ pip_install_options | default('') }} - register: install_packages - until: install_packages|success - retries: 5 - delay: 2 - - name: Retrieve checksum for venv download uri: url: "{{ zun_venv_download_url | replace('tgz', 'checksum') }}" diff --git a/tasks/zun_service_setup.yml b/tasks/zun_service_setup.yml index f6fc546..1b09269 100644 --- a/tasks/zun_service_setup.yml +++ b/tasks/zun_service_setup.yml @@ -13,150 +13,91 @@ # See the License for the specific language governing permissions and # limitations under the License. -- name: Run the openstack openrc role - include_role: - name: openstack_openrc - private: true +# We set the python interpreter to the ansible runtime venv if +# the delegation is to localhost so that we get access to the +# appropriate python libraries in that venv. If the delegation +# is to another host, we assume that it is accessible by the +# system python instead. +- name: Setup the service + delegate_to: "{{ zun_service_setup_host }}" + vars: + ansible_python_interpreter: >- + {{ (zun_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_python['executable']) }} + block: + - name: Add service to the keystone service catalog + os_keystone_service: + cloud: default + state: present + name: "{{ zun_service_name }}" + service_type: "{{ zun_service_type }}" + description: "{{ zun_service_description }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + until: add_service is success + retries: 5 + delay: 10 -# Create a service -- name: Ensure zun service - keystone: - command: "ensure_service" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - service_name: "{{ zun_service_name }}" - service_type: "{{ zun_service_type }}" - description: "{{ zun_service_description }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - until: add_service | success - retries: 5 - delay: 2 - no_log: True - tags: - - zun-api-setup - - zun-service-add - - zun-setup + - name: Add service user + os_user: + cloud: default + state: present + name: "{{ item.name }}" + password: "{{ item.password }}" + domain: default + default_project: "{{ zun_service_project_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + when: not zun_service_in_ldap | bool + until: add_service is success + retries: 5 + delay: 10 + no_log: True + with_items: + - name: "{{ zun_service_user_name }}" + password: "{{ zun_service_password }}" + - name: "{{ zun_kuryr_service_username }}" + password: "{{ zun_kuryr_service_password }}" + loop_control: + label: "{{ item.name }}" -# Create an admin user -- name: Ensure zun user - keystone: - command: "ensure_user" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - user_name: "{{ zun_service_user_name }}" - tenant_name: "{{ zun_service_project_name }}" - password: "{{ zun_service_password }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - when: - - not zun_service_in_ldap | bool - until: add_service | success - retries: 5 - delay: 10 - no_log: True - tags: - - zun-api-setup - - zun-service-add - - zun-setup + - name: Add service user to admin role + os_user_role: + cloud: default + state: present + user: "{{ item }}" + role: "{{ zun_service_role_name }}" + project: "{{ zun_service_project_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + when: not zun_service_in_ldap | bool + until: add_service is success + retries: 5 + delay: 10 + with_items: + - "{{ zun_service_user_name }}" + - "{{ zun_kuryr_service_username }}" -# Add a role to the user -- name: Ensure zun user to admin role - keystone: - command: "ensure_user_role" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - user_name: "{{ zun_service_user_name }}" - tenant_name: "{{ zun_service_project_name }}" - role_name: "{{ zun_service_role_name }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - when: - - not zun_service_in_ldap | bool - until: add_service | success - retries: 5 - delay: 10 - no_log: True - tags: - - zun-api-setup - - zun-service-add - - zun-setup - -# Create an endpoint -- name: Ensure zun endpoint - keystone: - command: "ensure_endpoint" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - region_name: "{{ zun_service_region }}" - service_name: "{{ zun_service_name }}" - service_type: "{{ zun_service_type }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - endpoint_list: - - url: "{{ zun_service_publicurl }}" - interface: "public" - - url: "{{ zun_service_internalurl }}" - interface: "internal" - - url: "{{ zun_service_adminurl }}" - interface: "admin" - register: add_service - until: add_service | success - retries: 5 - delay: 10 - no_log: True - tags: - - zun-api-setup - - zun-service-add - - zun-setup - -# Create an admin user -- name: Ensure zun kuryr user - keystone: - command: "ensure_user" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - user_name: "{{ zun_kuryr_service_username }}" - tenant_name: "{{ zun_service_project_name }}" - password: "{{ zun_kuryr_service_password }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - when: not zun_service_in_ldap | bool - until: add_service | success - retries: 5 - delay: 10 - no_log: True - tags: - - zun-api-setup - - zun-service-add - -# Add a role to the user -- name: Ensure zun kuryr user to admin role - keystone: - command: "ensure_user_role" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - user_name: "{{ zun_kuryr_service_username }}" - tenant_name: "{{ zun_service_project_name }}" - role_name: "{{ zun_service_role_name }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - when: not zun_service_in_ldap | bool - until: add_service | success - retries: 5 - delay: 10 - no_log: True - tags: - - zun-api-setup - - zun-service-add + - name: Add endpoints to keystone endpoint catalog + os_keystone_endpoint: + cloud: default + state: present + service: "{{ zun_service_name }}" + endpoint_interface: "{{ item.interface }}" + url: "{{ item.url }}" + region: "{{ zun_service_region }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + until: add_service is success + retries: 5 + delay: 10 + with_items: + - interface: "public" + url: "{{ zun_service_publicurl }}" + - interface: "internal" + url: "{{ zun_service_internalurl }}" + - interface: "admin" + url: "{{ zun_service_adminurl }}" diff --git a/tests/host_vars/localhost.yml b/tests/host_vars/localhost.yml index 4c84cab..d1ca8e5 100644 --- a/tests/host_vars/localhost.yml +++ b/tests/host_vars/localhost.yml @@ -14,7 +14,6 @@ # limitations under the License. ansible_host: 10.1.1.1 -ansible_python_interpreter: "/usr/bin/python2" neutron_provider_networks: network_types: "vxlan,flat" diff --git a/tests/test-install-zun.yml b/tests/test-install-zun.yml index 9b98489..7fcd070 100644 --- a/tests/test-install-zun.yml +++ b/tests/test-install-zun.yml @@ -15,7 +15,7 @@ - name: Installation and setup of Zun hosts: zun_all - become: true + remote_user: root roles: - role: "os_zun" zun_rabbitmq_password: secrete