Use RDO/UCA everywhere

The pip_install role installs binary dependencies, like python-openssl
(on Ubuntu), or pyOpenSSL (on Centos).

By default, we didn't configure extra sources (like UCA or RDO)
in the pip_install role. Because the repo is built using UCA or RDO
(current default), we could have inconsistency issues:
containers that haven't UCA or RDO applied during their role execution
would run with a venv packaged for a different python-openssl
(or python-cryptography).

This commit brings the consistency by installing UCA/RDO everywhere.

Closes-Bug: 1624791

Change-Id: I9b5cd40b2972c93af348d4ddfde21a038cf9becc
Signed-off-by: Jean-Philippe Evrard <jean-philippe.evrard@rackspace.co.uk>

defaults/main.yml

@@ -13,6 +13,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+uca_enable: True
+uca_apt_repo_url: "http://ubuntu-cloud.archive.canonical.com/ubuntu"
+
 # Set the package install state for distribution packages
 # Options are 'present' and 'latest'
 pip_install_package_state: "latest"

tasks/pre_install.yml

@@ -13,28 +13,42 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- name: Install yum packages
-  yum:
-    pkg: "{{ item }}"
-    state: "{{ pip_install_package_state }}"
-  register: install_packages
-  until: install_packages|success
-  retries: 5
-  delay: 2
-  with_items: "{{ pip_install_distro_packages }}"
-  when:
-    - ansible_pkg_mgr == 'yum'
-
-- name: Install apt packages
+- name: Ensure apt cache is up to date
   apt:
-    pkg: "{{ item }}"
-    state: "{{ pip_install_package_state }}"
     update_cache: yes
     cache_valid_time: "{{ cache_timeout }}"
+  when:
+    - ansible_pkg_mgr == 'apt'
+
+- name: Install external repo key package
+  package:
+    name: "{{ pip_install_external_repo_key_package }}"
+    state: "{{ pip_install_package_state }}"
+  tags:
+    - add-repo-keys
+
+- name: Install repo for distro binaries
+  apt_repository:
+    repo: "{{ uca_repo }}"
+    state: present
+    update_cache: yes
+    filename: "{{ uca_apt_source_list_filename | default(omit) }}"
+  register: uca_add_repo
+  until: uca_add_repo|success
+  retries: 5
+  delay: 2
+  when:
+    - ansible_pkg_mgr == 'apt'
+    - uca_enable
+  tags:
+    - add-uca-repo
+
+- name: Install packages
+  package:
+    name: "{{ item }}"
+    state: "{{ pip_install_package_state }}"
   register: install_packages
   until: install_packages|success
   retries: 5
   delay: 2
   with_items: "{{ pip_install_distro_packages }}"
-  when:
-    - ansible_pkg_mgr == 'apt'

vars/redhat-7.yml

@@ -13,6 +13,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+#TODO(evrardjp): bump to ocata when published.
+pip_install_external_repo_key_package: "centos-release-openstack-newton"
+
 pip_install_distro_build_packages:
   - gcc
   - libffi-devel

vars/ubuntu-16.04.yml

@@ -13,6 +13,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# Ubuntu Cloud Archive variables
+uca_openstack_release: ocata
+uca_repo_dist: "{{ ansible_lsb.codename }}-updates/{{ uca_openstack_release }}"
+uca_repo: "deb {{ uca_apt_repo_url }} {{ uca_repo_dist }} main"
+pip_install_external_repo_key_package: "ubuntu-cloud-keyring"
+
 pip_install_distro_build_packages:
   - build-essential
   - python-dev