Merge "Perform an atomic policy file change"

handlers/main.yml

@@ -12,10 +12,52 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+
 - name: Restart glance services
-  systemd:
+  debug:
+    msg: "Restarting services"
+  changed_when: true
+  notify:
+    - Stop services
+    - Copy new policy file into place
+    - Start services
+
+- name: Stop services
+  service:
     name: "{{ item.value.service_name }}"
-    state: "restarted"
+    enabled: yes
-    daemon_reload: yes
+    state: "stopped"
+    daemon_reload: "{{ (ansible_service_mgr == 'systemd') | ternary('yes', omit) }}"
   with_dict: "{{ glance_services }}"
   when: inventory_hostname in groups[item.value.group]
+  register: _stop
+  until: _stop | success
+  retries: 5
+  delay: 2
+
+# Note (odyssey4me):
+# The policy.json file is currently read continually by the services
+# and is not only read on service start. We therefore cannot template
+# directly to the file read by the service because the new policies
+# may not be valid until the service restarts. This is particularly
+# important during a major upgrade. We therefore only put the policy
+# file in place after the service has been stopped.
+#
+- name: Copy new policy file into place
+  copy:
+    src: "/etc/glance/policy.json-{{ glance_venv_tag }}"
+    dest: "/etc/glance/policy.json"
+    remote_src: yes
+
+- name: Start services
+  service:
+    name: "{{ item.value.service_name }}"
+    enabled: yes
+    state: "started"
+    daemon_reload: "{{ (ansible_service_mgr == 'systemd') | ternary('yes', omit) }}"
+  with_dict: "{{ glance_services }}"
+  when: inventory_hostname in groups[item.value.group]
+  register: _start
+  until: _start | success
+  retries: 5
+  delay: 2

tasks/glance_init_common.yml

@@ -1,27 +0,0 @@
----
-# Copyright 2016, Rackspace US, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-- include: glance_init_systemd.yml
-  when:
-    - ansible_service_mgr == 'systemd'
-
-- name: Load service
-  service:
-   name: "{{ item.value.service_name }}"
-   enabled: "yes"
-  with_dict: "{{ glance_services }}"
-  when: inventory_hostname in groups[item.value.group]
-  notify:
-    - Restart glance services

tasks/glance_init_systemd.yml

@@ -52,6 +52,8 @@
     group: "root"
   with_dict: "{{ glance_services }}"
   when: inventory_hostname in groups[item.value.group]
+  notify:
+    - Restart glance services
 
 - name: Place the systemd init script
   config_template:

tasks/glance_post_install.yml

@@ -56,7 +56,7 @@
       config_overrides: "{{ glance_glance_swift_store_conf_overrides }}"
       config_type: "ini"
     - src: "policy.json.j2"
-      dest: "/etc/glance/policy.json"
+      dest: "/etc/glance/policy.json-{{ glance_venv_tag }}"
       config_overrides: "{{ glance_policy_overrides }}"
       config_type: "json"
     - src: "schema.json.j2"

tasks/main.yml

@@ -37,7 +37,7 @@
   tags:
     - glance-config
 
-- include: glance_init_common.yml
+- include: "glance_init_{{ ansible_service_mgr }}.yml"
   tags:
     - glance-config