Merge "Disable glance-registry and the v1 API by default"

defaults/main.yml

@@ -66,9 +66,12 @@ glance_show_multiple_locations: "{{ glance_default_store == 'rbd' }}"
 
 
 ## API options
-glance_enable_v1_api: True
+# The v1 API is deprecated and scheduled for removal in Queens.
+glance_enable_v1_api: False
 glance_enable_v2_api: True
-glance_enable_v2_registry: True
+# The v2 API does not require the registry service.
+# The registry service is scheduled for removal in the S cycle.
+glance_enable_v2_registry: False
 
 ## RabbitMQ info
 

handlers/main.yml

@@ -26,6 +26,56 @@
   delay: 2
   listen: "Restart glance services"
 
+# TODO(odyssey4me):
+# Assuming glance-registry is removed in the S cycle as planned, this
+# task can be removed in the T cycle.
+# Note that this uses shell task because the unit may not exist. When it
+# does not exist, the ansible task which stops/disables it fails and it
+# is important that we see failures, but get failures in the right
+# circumstances.
+- name: Stop and disable glance-registry when it is no longer used
+  shell: |
+    return_code=0
+    if [[ "$(systemctl is-active {{ glance_services['glance-registry']['service_name'] }})" == "active" ]]; then
+      systemctl stop {{ glance_services['glance-registry']['service_name'] }}
+      return_code=2
+    fi
+    if [[ "$(systemctl is-enabled {{ glance_services['glance-registry']['service_name'] }})" == "enabled" ]]; then
+      systemctl disable {{ glance_services['glance-registry']['service_name'] }}
+      return_code=2
+    fi
+    exit ${return_code}
+  args:
+    executable: /bin/bash
+  when:
+    - not glance_services['glance-registry']['condition']
+  register: _remove_glance_service
+  changed_when: _remove_glance_service.rc == 2
+  failed_when: _remove_glance_service.rc not in [0, 2]
+  listen: "Restart glance services"
+  # This task causes ansible-lint to give a ANSIBLE0014
+  # error, which does not make much sense given how the
+  # environment variable is used in this case.
+  # TODO(odyssey4me):
+  # Try to understand the issue ansible-lint is trying
+  # to highlight and address it.
+  tags:
+    - skip_ansible_lint
+
+# TODO(odyssey4me):
+# Assuming glance-registry is removed in the S cycle as planned, this
+# task can be removed in the T cycle.
+- name: Clean up glance-registry init files when they are no longer needed
+  file:
+    path: "{{ item }}"
+    state: absent
+  with_items:
+    - "/etc/tmpfiles.d/openstack-{{ glance_services['glance-registry']['service_name'] }}.conf"
+    - "/etc/systemd/system/{{ glance_services['glance-registry']['service_name'] }}.service"
+  when:
+    - not glance_services['glance-registry']['condition']
+  listen: "Restart glance services"
+
 # Note (odyssey4me):
 # The policy.json file is currently read continually by the services
 # and is not only read on service start. We therefore cannot template

releasenotes/notes/glance-v2-api-only-0d4a61b0d4dade18.yaml

@@ -1,4 +1,13 @@
 ---
+upgrade:
+  - |
+    The glance v1 API is now disabled by default as the API is scheduled
+    to be removed in Queens.
+  - |
+    The glance registry service is now disabled by default as it is not
+    required for the v2 API and is scheduled to be removed in the future.
+    The service can be enabled by setting ``glance_enable_v2_registry``
+    to ``True``.
 deprecations:
   - |
     The ``glance_enable_v1_registry`` variable has been removed. When using

tasks/glance_init_systemd.yml

@@ -31,15 +31,6 @@
     mode: "02755"
   with_items: "{{ filtered_glance_services }}"
 
-# TODO(mgariepy):
-# Remove this in Pike as it only needed to handle upgrades
-# from Newton->Newton and Newton->Ocata
-- name: Cleanup old tmpfiles.d entry
-  file:
-    path: "/etc/tmpfiles.d/{{ item.service_name }}.conf"
-    state: absent
-  with_items: "{{ filtered_glance_services }}"
-
 - name: Create tmpfiles.d entry
   template:
     src: "glance-systemd-tmpfiles.j2"

tests/test-glance-functional.yml

@@ -35,7 +35,7 @@
         url: "http://localhost:9191"
         status_code: 401
       when:
-        - (glance_enable_v1_api | default(True)) | bool or (glance_enable_v2_registry | default(True)) | bool
+        - (glance_enable_v1_api | default(False)) | bool or (glance_enable_v2_registry | default(False)) | bool
 
     - name: Download the Cirros image
       get_url:

tox.ini

@@ -115,12 +115,23 @@ commands =
     bash -c "{toxinidir}/tests/test-glance-upgrades.sh"
 
 
-[testenv:v2_api_only]
+[testenv:v1_api_enabled]
 deps =
     {[testenv:ansible]deps}
 setenv =
     {[testenv]setenv}
-    ANSIBLE_PARAMETERS=-e glance_enable_v1_api=False -e glance_enable_v2_registry=False
+    ANSIBLE_PARAMETERS=-e glance_enable_v1_api=True
+commands =
+    bash -c "{toxinidir}/tests/tests-repo-clone.sh"
+    bash -c "{toxinidir}/tests/common/test-ansible-functional.sh"
+
+
+[testenv:v2_registry_enabled]
+deps =
+    {[testenv:ansible]deps}
+setenv =
+    {[testenv]setenv}
+    ANSIBLE_PARAMETERS=-e glance_enable_v2_registry=True
 commands =
     bash -c "{toxinidir}/tests/tests-repo-clone.sh"
     bash -c "{toxinidir}/tests/common/test-ansible-functional.sh"

zuul.d/jobs.yaml

@@ -14,8 +14,15 @@
 # limitations under the License.
 
 - job:
-    name: openstack-ansible-v2_api_only
+    name: openstack-ansible-v1_api_enabled
     parent: openstack-ansible-functional
     nodeset: ubuntu-xenial
     vars:
-      tox_env: v2_api_only
+      tox_env: v1_api_enabled
+
+- job:
+    name: openstack-ansible-v2_registry_enabled
+    parent: openstack-ansible-functional
+    nodeset: ubuntu-xenial
+    vars:
+      tox_env: v2_registry_enabled

zuul.d/project.yaml

@@ -22,7 +22,8 @@
         - openstack-ansible-functional-opensuse-423
         - openstack-ansible-functional-ubuntu-xenial
         - openstack-ansible-upgrade-ubuntu-xenial
-        - openstack-ansible-v2_api_only
+        - openstack-ansible-v1_api_enabled
+        - openstack-ansible-v2_registry_enabled
     gate:
       jobs:
         - openstack-ansible-linters
@@ -30,4 +31,6 @@
         - openstack-ansible-functional-opensuse-423
         - openstack-ansible-functional-ubuntu-xenial
         - openstack-ansible-upgrade-ubuntu-xenial
-        - openstack-ansible-v2_api_only
+        - openstack-ansible-v1_api_enabled
+        - openstack-ansible-v2_registry_enabled
+