Merge "Execute service setup against a delegated host using Ansible built-in modules"

defaults/main.yml

@@ -18,6 +18,11 @@
 # Verbosity Options
 debug: False
 
+# Set the host which will execute the shade modules
+# for the service setup. The host must already have
+# clouds.yaml properly configured.
+ironic_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}"
+
 # Comma separated list of Glance API servers
 ironic_glance_api_servers: "{{ (glance_service_internalurl | default('http://localhost')) | netorigin }}"
 
@@ -201,11 +206,6 @@ ironic_venv_download_url: http://127.0.0.1/venvs/untagged/ubuntu/ironic.tgz
 
 ironic_tftp_server_address: "{{ ansible_host }}"
 
-ironic_requires_pip_packages:
-  - virtualenv
-  - python-keystoneclient # Keystoneclient needed for the OSA keystone lib
-  - httplib2 # for Ansible's uri module
-
 ironic_oneview_optional_pip_packages:
   - ironic-oneview-cli
   - ironic-oneviewd

meta/main.yml

@@ -32,4 +32,3 @@ dependencies:
     when:
       - ansible_pkg_mgr == 'apt'
   - galera_client
-  - openstack_openrc

releasenotes/notes/ironic-service-setup-host-658842e1875ea7bf.yaml

@@ -0,0 +1,17 @@
+---
+features:
+  - |
+    The service setup in keystone for ironic will now be executed
+    through delegation to the ``ironic_service_setup_host`` which,
+    by default, is ``localhost`` (the deploy host). Deployers can
+    opt to rather change this to the utility container by implementing
+    the following override in ``user_variables.yml``.
+
+    .. code-block:: yaml
+
+      ironic_service_setup_host: "{{ groups['utility_all'][0] }}"
+
+deprecations:
+  - |
+    The variable ``ironic_requires_pip_packages`` is no longer required
+    and has therefore been removed.

tasks/ironic_install.yml

@@ -33,19 +33,6 @@
       {% endfor %}
   when: ironic_developer_mode | bool
 
-- name: Install requires pip packages
-  pip:
-    name: "{{ ironic_requires_pip_packages }}"
-    state: "{{ ironic_pip_package_state }}"
-    extra_args: >-
-      {{ ironic_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }}
-      {{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }}
-      {{ pip_install_options | default('') }}
-  register: install_packages
-  until: install_packages|success
-  retries: 5
-  delay: 2
-
 - name: Retrieve checksum for venv download
   uri:
     url: "{{ ironic_venv_download_url | replace('tgz', 'checksum') }}"

tasks/ironic_service_setup.yml

@@ -13,83 +13,81 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Create a service
-- name: Ensure ironic service
-  keystone:
-    command: "ensure_service"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    endpoint: "{{ keystone_service_adminurl }}"
-    service_name: "{{ ironic_service_name }}"
-    service_type: "{{ ironic_service_type }}"
-    description: "{{ ironic_service_description }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-  register: add_service
-  until: add_service|success
-  retries: 5
-  delay: 2
-  no_log: true
+# We set the python interpreter to the ansible runtime venv if
+# the delegation is to localhost so that we get access to the
+# appropriate python libraries in that venv. If the delegation
+# is to another host, we assume that it is accessible by the
+# system python instead.
+- name: Setup the service
+  delegate_to: "{{ ironic_service_setup_host }}"
+  vars:
+    ansible_python_interpreter: >-
+      {{ (ironic_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_python['executable']) }}
+  block:
+    - name: Add service to the keystone service catalog
+      os_keystone_service:
+        cloud: default
+        state: present
+        name: "{{ ironic_service_name }}"
+        service_type: "{{ ironic_service_type }}"
+        description: "{{ ironic_service_description }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service
+      until: add_service is success
+      retries: 5
+      delay: 10
 
-# Create an admin user
-- name: Ensure ironic user
-  keystone:
-    command: "ensure_user"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    endpoint: "{{ keystone_service_adminurl }}"
-    user_name: "{{ ironic_service_user_name }}"
-    project_name: "{{ ironic_service_project_name }}"
-    password: "{{ ironic_service_password }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-  register: add_service
-  when: not ironic_service_in_ldap | bool
-  until: add_service|success
-  retries: 5
-  delay: 10
-  no_log: true
+    - name: Add service user
+      os_user:
+        cloud: default
+        state: present
+        name: "{{ ironic_service_user_name }}"
+        password: "{{ ironic_service_password }}"
+        domain: default
+        default_project: "{{ ironic_service_project_name }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service
+      when: not ironic_service_in_ldap | bool
+      until: add_service is success
+      retries: 5
+      delay: 10
+      no_log: True
 
-# Add a role to the user
-- name: Ensure ironic user to admin role
-  keystone:
-    command: "ensure_user_role"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    endpoint: "{{ keystone_service_adminurl }}"
-    user_name: "{{ ironic_service_user_name }}"
-    project_name: "{{ ironic_service_project_name }}"
-    role_name: "{{ ironic_service_role_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-  register: add_service
-  when: not ironic_service_in_ldap | bool
-  until: add_service|success
-  retries: 5
-  delay: 10
-  no_log: true
+    - name: Add service user to admin role
+      os_user_role:
+        cloud: default
+        state: present
+        user: "{{ ironic_service_user_name }}"
+        role: "{{ ironic_service_role_name }}"
+        project: "{{ ironic_service_project_name }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service
+      when: not ironic_service_in_ldap | bool
+      until: add_service is success
+      retries: 5
+      delay: 10
 
-# Create an endpoint
-- name: Ensure ironic endpoint
-  keystone:
-    command: "ensure_endpoint"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    endpoint: "{{ keystone_service_adminurl }}"
-    region_name: "{{ ironic_service_region }}"
-    service_name: "{{ ironic_service_name }}"
-    service_type: "{{ ironic_service_type }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-    endpoint_list:
-      - url: "{{ ironic_service_publicurl }}"
-        interface: "public"
-      - url: "{{ ironic_service_internalurl }}"
-        interface: "internal"
-      - url: "{{ ironic_service_adminurl }}"
-        interface: "admin"
-  register: add_service
-  until: add_service|success
-  retries: 5
-  delay: 10
-  no_log: true
+    - name: Add endpoints to keystone endpoint catalog
+      os_keystone_endpoint:
+        cloud: default
+        state: present
+        service: "{{ ironic_service_name }}"
+        endpoint_interface: "{{ item.interface }}"
+        url: "{{ item.url }}"
+        region: "{{ ironic_service_region }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      register: add_service
+      until: add_service is success
+      retries: 5
+      delay: 10
+      with_items:
+        - interface: "public"
+          url: "{{ ironic_service_publicurl }}"
+        - interface: "internal"
+          url: "{{ ironic_service_internalurl }}"
+        - interface: "admin"
+          url: "{{ ironic_service_adminurl }}"

tests/host_vars/localhost.yml

@@ -14,7 +14,6 @@
 # limitations under the License.
 
 neutron_local_ip:  10.1.2.1
-ansible_python_interpreter: "/usr/bin/python2"
 bridges:
   - name: "br-mgmt"
     ip_addr: "10.1.1.1"

tests/test-configure-ironic.yml

@@ -15,20 +15,13 @@
 
 - name: Setup localhost requirements
   hosts: localhost
-  become: True
-  gather_facts: True
+  connection: local
+  gather_facts: false
+  vars_files:
+    - common/test-vars.yml
+  vars:
+    ansible_python_interpreter: "{{ ansible_playbook_python }}"
   tasks:
-    - name: Install pip requirements
-      pip:
-        name: "{{ item }}"
-        state: "{{ ironic_pip_package_state }}"
-      with_items:
-        - python-neutronclient
-        - shade
-      register: install_packages
-      until: install_packages|success
-      retries: 5
-      delay: 2
     - name: Create br-prov network
       os_network:
         cloud: default
@@ -37,6 +30,7 @@
         name: "{{ ironic_neutron_provisioning_network_name }}"
         provider_network_type: flat
         provider_physical_network: prov
+
     - name: Ensure public subnet exists
       os_subnet:
         state: present
@@ -46,5 +40,3 @@
         network_name: "{{ ironic_neutron_provisioning_network_name }}"
         name: "ironic-prov-subnet"
         cidr: "10.1.6.0/24"
-  vars_files:
-    - common/test-vars.yml