From 4fa98725102f98700ddc0844272222ab7b8bfea1 Mon Sep 17 00:00:00 2001 From: Jesse Pretorius Date: Sat, 18 Nov 2017 17:16:48 +0000 Subject: [PATCH] Disable glance-registry and the v1 API by default When using the glance v2 API the glance-registry service is optional, and the intention is to remove the glance-registry service in the S cycle. The glance v1 API is scheduled to be removed in Queens. This patch therefore disables the v1 API by default to give us as much time as possible to identify the impact of that and to get the issues resolved before it is removed from the code-base. The patch also cleans up the glance-registry init files to handle the transition in an existing environment. Tests are added to validate that enabling the v1 API still works, and enabling the v2 registry still works. Change-Id: I4c27aa0ca5b649e4fa76cfd0f326d80f50074db1 --- defaults/main.yml | 7 ++- handlers/main.yml | 50 +++++++++++++++++++ .../glance-v2-api-only-0d4a61b0d4dade18.yaml | 9 ++++ tasks/glance_init_systemd.yml | 9 ---- tests/test-glance-functional.yml | 2 +- tox.ini | 15 +++++- zuul.d/jobs.yaml | 11 +++- zuul.d/project.yaml | 7 ++- 8 files changed, 92 insertions(+), 18 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index c9779383..909c3fb3 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -66,9 +66,12 @@ glance_show_multiple_locations: "{{ glance_default_store == 'rbd' }}" ## API options -glance_enable_v1_api: True +# The v1 API is deprecated and scheduled for removal in Queens. +glance_enable_v1_api: False glance_enable_v2_api: True -glance_enable_v2_registry: True +# The v2 API does not require the registry service. +# The registry service is scheduled for removal in the S cycle. +glance_enable_v2_registry: False ## RabbitMQ info diff --git a/handlers/main.yml b/handlers/main.yml index 63871f4a..be61cceb 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -26,6 +26,56 @@ delay: 2 listen: "Restart glance services" +# TODO(odyssey4me): +# Assuming glance-registry is removed in the S cycle as planned, this +# task can be removed in the T cycle. +# Note that this uses shell task because the unit may not exist. When it +# does not exist, the ansible task which stops/disables it fails and it +# is important that we see failures, but get failures in the right +# circumstances. +- name: Stop and disable glance-registry when it is no longer used + shell: | + return_code=0 + if [[ "$(systemctl is-active {{ glance_services['glance-registry']['service_name'] }})" == "active" ]]; then + systemctl stop {{ glance_services['glance-registry']['service_name'] }} + return_code=2 + fi + if [[ "$(systemctl is-enabled {{ glance_services['glance-registry']['service_name'] }})" == "enabled" ]]; then + systemctl disable {{ glance_services['glance-registry']['service_name'] }} + return_code=2 + fi + exit ${return_code} + args: + executable: /bin/bash + when: + - not glance_services['glance-registry']['condition'] + register: _remove_glance_service + changed_when: _remove_glance_service.rc == 2 + failed_when: _remove_glance_service.rc not in [0, 2] + listen: "Restart glance services" + # This task causes ansible-lint to give a ANSIBLE0014 + # error, which does not make much sense given how the + # environment variable is used in this case. + # TODO(odyssey4me): + # Try to understand the issue ansible-lint is trying + # to highlight and address it. + tags: + - skip_ansible_lint + +# TODO(odyssey4me): +# Assuming glance-registry is removed in the S cycle as planned, this +# task can be removed in the T cycle. +- name: Clean up glance-registry init files when they are no longer needed + file: + path: "{{ item }}" + state: absent + with_items: + - "/etc/tmpfiles.d/openstack-{{ glance_services['glance-registry']['service_name'] }}.conf" + - "/etc/systemd/system/{{ glance_services['glance-registry']['service_name'] }}.service" + when: + - not glance_services['glance-registry']['condition'] + listen: "Restart glance services" + # Note (odyssey4me): # The policy.json file is currently read continually by the services # and is not only read on service start. We therefore cannot template diff --git a/releasenotes/notes/glance-v2-api-only-0d4a61b0d4dade18.yaml b/releasenotes/notes/glance-v2-api-only-0d4a61b0d4dade18.yaml index bc087bc3..8ca76496 100644 --- a/releasenotes/notes/glance-v2-api-only-0d4a61b0d4dade18.yaml +++ b/releasenotes/notes/glance-v2-api-only-0d4a61b0d4dade18.yaml @@ -1,4 +1,13 @@ --- +upgrade: + - | + The glance v1 API is now disabled by default as the API is scheduled + to be removed in Queens. + - | + The glance registry service is now disabled by default as it is not + required for the v2 API and is scheduled to be removed in the future. + The service can be enabled by setting ``glance_enable_v2_registry`` + to ``True``. deprecations: - | The ``glance_enable_v1_registry`` variable has been removed. When using diff --git a/tasks/glance_init_systemd.yml b/tasks/glance_init_systemd.yml index 0f2a01c8..33b2cd62 100644 --- a/tasks/glance_init_systemd.yml +++ b/tasks/glance_init_systemd.yml @@ -31,15 +31,6 @@ mode: "02755" with_items: "{{ filtered_glance_services }}" -# TODO(mgariepy): -# Remove this in Pike as it only needed to handle upgrades -# from Newton->Newton and Newton->Ocata -- name: Cleanup old tmpfiles.d entry - file: - path: "/etc/tmpfiles.d/{{ item.service_name }}.conf" - state: absent - with_items: "{{ filtered_glance_services }}" - - name: Create tmpfiles.d entry template: src: "glance-systemd-tmpfiles.j2" diff --git a/tests/test-glance-functional.yml b/tests/test-glance-functional.yml index a729f48b..1cc54410 100644 --- a/tests/test-glance-functional.yml +++ b/tests/test-glance-functional.yml @@ -35,7 +35,7 @@ url: "http://localhost:9191" status_code: 401 when: - - (glance_enable_v1_api | default(True)) | bool or (glance_enable_v2_registry | default(True)) | bool + - (glance_enable_v1_api | default(False)) | bool or (glance_enable_v2_registry | default(False)) | bool - name: Download the Cirros image get_url: diff --git a/tox.ini b/tox.ini index 90c71e5d..b28efda8 100644 --- a/tox.ini +++ b/tox.ini @@ -115,12 +115,23 @@ commands = bash -c "{toxinidir}/tests/test-glance-upgrades.sh" -[testenv:v2_api_only] +[testenv:v1_api_enabled] deps = {[testenv:ansible]deps} setenv = {[testenv]setenv} - ANSIBLE_PARAMETERS=-e glance_enable_v1_api=False -e glance_enable_v2_registry=False + ANSIBLE_PARAMETERS=-e glance_enable_v1_api=True +commands = + bash -c "{toxinidir}/tests/tests-repo-clone.sh" + bash -c "{toxinidir}/tests/common/test-ansible-functional.sh" + + +[testenv:v2_registry_enabled] +deps = + {[testenv:ansible]deps} +setenv = + {[testenv]setenv} + ANSIBLE_PARAMETERS=-e glance_enable_v2_registry=True commands = bash -c "{toxinidir}/tests/tests-repo-clone.sh" bash -c "{toxinidir}/tests/common/test-ansible-functional.sh" diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml index efc0d18a..e6b4d02d 100644 --- a/zuul.d/jobs.yaml +++ b/zuul.d/jobs.yaml @@ -14,8 +14,15 @@ # limitations under the License. - job: - name: openstack-ansible-v2_api_only + name: openstack-ansible-v1_api_enabled parent: openstack-ansible-functional nodeset: ubuntu-xenial vars: - tox_env: v2_api_only + tox_env: v1_api_enabled + +- job: + name: openstack-ansible-v2_registry_enabled + parent: openstack-ansible-functional + nodeset: ubuntu-xenial + vars: + tox_env: v2_registry_enabled diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml index 81f64037..69d73f2e 100644 --- a/zuul.d/project.yaml +++ b/zuul.d/project.yaml @@ -22,7 +22,8 @@ - openstack-ansible-functional-opensuse-423 - openstack-ansible-functional-ubuntu-xenial - openstack-ansible-upgrade-ubuntu-xenial - - openstack-ansible-v2_api_only + - openstack-ansible-v1_api_enabled + - openstack-ansible-v2_registry_enabled gate: jobs: - openstack-ansible-linters @@ -30,4 +31,6 @@ - openstack-ansible-functional-opensuse-423 - openstack-ansible-functional-ubuntu-xenial - openstack-ansible-upgrade-ubuntu-xenial - - openstack-ansible-v2_api_only + - openstack-ansible-v1_api_enabled + - openstack-ansible-v2_registry_enabled +