Update packages in virtualenvs

Kayobe uses a number of virtual environments on the remote hosts for
python dependencies such as shade, python-openstackclient, docker, etc.
By default these are stored in /opt/kayobe/venvs/. Typically we do not
provide version restrictions when installing these packages, so over the
course of time they may become stale and incompatible.

This change installs the latest version of packages allowed by OpenStack
upper constraints.

It also adds a new variable, 'pip_upper_constraints_file', to set the
upper constraints file. The existing variable
'kolla_upper_constraints_file' now defaults to the value of
'pip_upper_constraints_file'.

Change-Id: I8d2956f95bbc44b5a9e88e7569372048a62f12f5
Story: 2005923
Task: 34193

ansible/baremetal-compute-inspect.yml

@@ -15,6 +15,8 @@
     - role: stackhpc.os-shade
       os_shade_venv: "{{ venv }}"
       os_shade_install_epel: "{{ yum_install_epel }}"
+      os_shade_state: latest
+      os_shade_upper_constraints_file: "{{ pip_upper_constraints_file }}"
 
     - role: activate-virtualenv
       activate_virtualenv_path: "{{ venv }}"

ansible/baremetal-compute-manage.yml

@@ -15,6 +15,8 @@
     - role: stackhpc.os-shade
       os_shade_venv: "{{ venv }}"
       os_shade_install_epel: "{{ yum_install_epel }}"
+      os_shade_state: latest
+      os_shade_upper_constraints_file: "{{ pip_upper_constraints_file }}"
 
     - role: activate-virtualenv
       activate_virtualenv_path: "{{ venv }}"

ansible/baremetal-compute-provide.yml

@@ -15,6 +15,8 @@
     - role: stackhpc.os-shade
       os_shade_venv: "{{ venv }}"
       os_shade_install_epel: "{{ yum_install_epel }}"
+      os_shade_state: latest
+      os_shade_upper_constraints_file: "{{ pip_upper_constraints_file }}"
 
     - role: activate-virtualenv
       activate_virtualenv_path: "{{ venv }}"

ansible/baremetal-compute-rename.yml

@@ -15,6 +15,8 @@
         name:
           - python-openstackclient
           - python-ironicclient
+        state: latest
+        extra_args: "{% if pip_upper_constraints_file %}-c {{ pip_upper_constraints_file }}{% endif %}"
 
 - name: Rename baremetal compute nodes
   hosts: baremetal-compute

ansible/baremetal-compute-serial-console.yml

@@ -15,6 +15,8 @@
         name:
           - python-openstackclient
           - python-ironicclient
+        state: latest
+        extra_args: "{% if pip_upper_constraints_file %}-c {{ pip_upper_constraints_file }}{% endif %}"
 
     - block:
        - name: Fail if allocation pool start not defined

ansible/docker.yml

@@ -4,7 +4,7 @@
   tags:
     - docker
   vars:
-    - docker_upper_constraints_file: "{{ kolla_upper_constraints_file }}"
+    - docker_upper_constraints_file: "{{ pip_upper_constraints_file }}"
   roles:
     - role: docker
       docker_daemon_mtu: "{{ public_net_name | net_mtu | default }}"

ansible/external-net.yml

@@ -5,6 +5,8 @@
   roles:
     - role: stackhpc.os-networks
       os_shade_install_epel: "{{ yum_install_epel }}"
+      os_shade_state: latest
+      os_shade_upper_constraints_file: "{{ pip_upper_constraints_file }}"
       os_networks_venv: "{{ virtualenv_path }}/shade"
       os_networks_openstack_auth_type: "{{ openstack_auth_type }}"
       os_networks_openstack_auth: "{{ openstack_auth }}"

ansible/group_vars/all/kolla

@@ -316,7 +316,7 @@ kolla_enable_tls_external: "no"
 kolla_openstack_logging_debug: "False"
 
 # Upper constraints file for installation of Kolla.
-kolla_upper_constraints_file: "https://opendev.org/openstack/requirements/raw/branch/{{ openstack_branch }}/upper-constraints.txt"
+kolla_upper_constraints_file: "{{ pip_upper_constraints_file }}"
 
 # User account to use for Kolla SSH access.
 kolla_ansible_user: kolla

ansible/group_vars/all/pip

@@ -0,0 +1,3 @@
+---
+# Upper constraints file for installation of python packages.
+pip_upper_constraints_file: "https://releases.openstack.org/constraints/upper/{{ openstack_release }}"

ansible/overcloud-docker-sdk-upgrade.yml

@@ -26,6 +26,6 @@
       pip:
         name: docker
         state: latest
-        extra_args: "{% if kolla_upper_constraints_file %}-c {{ kolla_upper_constraints_file }}{% endif %}"
+        extra_args: "{% if pip_upper_constraints_file %}-c {{ pip_upper_constraints_file }}{% endif %}"
         virtualenv: "{{ virtualenv is defined | ternary(virtualenv, omit) }}"
       become: "{{ virtualenv is not defined }}"

ansible/overcloud-grafana-configure.yml

@@ -19,6 +19,8 @@
     - role: stackhpc.os-openstackclient
       os_openstackclient_venv: "{{ venv }}"
       os_openstackclient_install_epel: "{{ yum_install_epel }}"
+      os_openstackclient_state: latest
+      os_openstackclient_upper_constraints_file: "{{ pip_upper_constraints_file }}"
       when: kolla_enable_monasca | bool
 
   tasks:

ansible/overcloud-introspection-rules-dell-lldp-workaround.yml

@@ -124,7 +124,9 @@
   roles:
     - role: ironic-inspector-rules
       os_shade_install_epel: "{{ yum_install_epel }}"
+      os_shade_state: latest
       ironic_inspector_venv: "{{ virtualenv_path }}/shade"
+      ironic_inspector_upper_constraints_file: "{{ pip_upper_constraints_file }}"
       ironic_inspector_auth_type: "{{ openstack_auth_type }}"
       ironic_inspector_auth: "{{ openstack_auth }}"
       ironic_inspector_cacert: "{{ openstack_cacert }}"

ansible/overcloud-introspection-rules.yml

@@ -36,6 +36,8 @@
       vars:
         os_openstackclient_venv: "{{ venv }}"
         os_openstackclient_install_epel: "{{ yum_install_epel }}"
+        os_openstackclient_state: latest
+        os_openstackclient_upper_constraints_file: "{{ pip_upper_constraints_file }}"
 
     - name: Retrieve the IPA kernel Glance image UUID
       shell: >
@@ -56,7 +58,9 @@
   roles:
     - role: ironic-inspector-rules
       os_shade_install_epel: "{{ yum_install_epel }}"
+      os_shade_state: latest
       ironic_inspector_venv: "{{ venv }}"
+      ironic_inspector_upper_constraints_file: "{{ pip_upper_constraints_file }}"
       ironic_inspector_auth_type: "{{ openstack_auth_type }}"
       ironic_inspector_auth: "{{ openstack_auth }}"
       ironic_inspector_cacert: "{{ openstack_cacert }}"

ansible/overcloud-ipa-build.yml

@@ -28,6 +28,8 @@
             name: stackhpc.os-images
           vars:
             os_images_venv: "{{ virtualenv_path }}/ipa-build-dib"
+            os_images_package_state: latest
+            os_images_upper_constraints_file: "{{ pip_upper_constraints_file }}"
             os_images_cache: "{{ image_cache_path }}"
             os_images_common: ""
             os_images_list:

ansible/overcloud-ipa-images.yml

@@ -100,7 +100,9 @@
   roles:
     - role: ipa-images
       os_shade_install_epel: "{{ yum_install_epel }}"
+      os_shade_state: latest
       ipa_images_venv: "{{ virtualenv_path }}/shade"
+      ipa_images_upper_constraints_file: "{{ pip_upper_constraints_file }}"
       ipa_images_openstack_auth_type: "{{ openstack_auth_type }}"
       ipa_images_openstack_auth: "{{ openstack_auth }}"
       ipa_images_openstack_auth_env: "{{ openstack_auth_env }}"

ansible/provision-net.yml

@@ -59,6 +59,9 @@
 
   roles:
     - role: stackhpc.os-networks
+      os_shade_install_epel: "{{ yum_install_epel }}"
+      os_shade_state: latest
+      os_shade_upper_constraints_file: "{{ pip_upper_constraints_file }}"
       os_networks_venv: "{{ virtualenv_path }}/shade"
       os_networks_auth_type: "{{ openstack_auth_type }}"
       os_networks_auth: "{{ openstack_auth }}"

ansible/roles/ipa-images/defaults/main.yml

@@ -2,6 +2,9 @@
 # Path to virtualenv in which to install shade and its dependencies.
 ipa_images_venv:
 
+# Upper constraints file for installation of python-ironicclient.
+ipa_images_upper_constraints_file:
+
 # Authentication type compatible with the 'os_image' Ansible module's
 # auth_type argument.
 ipa_images_openstack_auth_type:

ansible/roles/ipa-images/meta/main.yml

@@ -2,5 +2,7 @@
 dependencies:
   - role: stackhpc.os-shade
     os_shade_venv: "{{ ipa_images_venv }}"
+    os_shade_upper_constraints_file: "{{ ipa_images_upper_constraints_file }}"
   - role: stackhpc.os-openstackclient
     os_openstackclient_venv: "{{ ipa_images_venv }}"
+    os_openstackclient_upper_constraints_file: "{{ ipa_images_upper_constraints_file }}"

ansible/roles/ipa-images/tasks/main.yml

@@ -59,7 +59,9 @@
 - name: Ensure we have python-ironicclient installed
   pip:
     name: python-ironicclient
+    state: latest
     virtualenv: "{{ ipa_images_venv }}"
+    extra_args: "{% if ipa_images_upper_constraints_file %}-c {{ ipa_images_upper_constraints_file }}{% endif %}"
 
 # To support updating the IPA image, we check the MD5 sum of the cached image
 # files, and compare with the images in Glance (if there are any).

ansible/roles/ironic-inspector-rules/defaults/main.yml

@@ -2,6 +2,9 @@
 # Path to a directory in which to create a virtualenv.
 ironic_inspector_venv:
 
+# Upper constraints file for installation of python-ironic-inspector-client.
+ironic_inspector_upper_constraints_file:
+
 # Authentication type.
 ironic_inspector_auth_type:
 

ansible/roles/ironic-inspector-rules/meta/main.yml

@@ -2,3 +2,4 @@
 dependencies:
   - role: stackhpc.os-shade
     os_shade_venv: "{{ ironic_inspector_venv }}"
+    os_shade_upper_constraints_file: "{{ ironic_inspector_upper_constraints_file }}"

ansible/roles/ironic-inspector-rules/tasks/main.yml

@@ -3,8 +3,9 @@
   pip:
     name: "{{ item.name }}"
     version: "{{ item.version | default(omit) }}"
-    state: present
+    state: latest
     virtualenv: "{{ ironic_inspector_venv }}"
+    extra_args: "{% if ironic_inspector_upper_constraints_file %}-c {{ ironic_inspector_upper_constraints_file }}{% endif %}"
   with_items:
     - name: python-ironic-inspector-client
 

ansible/seed-introspection-rules.yml

@@ -6,7 +6,9 @@
   roles:
     - role: ironic-inspector-rules
       os_shade_install_epel: "{{ yum_install_epel }}"
+      os_shade_state: latest
       ironic_inspector_venv: "{{ virtualenv_path }}/shade"
+      ironic_inspector_upper_constraints_file: "{{ pip_upper_constraints_file }}"
       # No auth required for Bifrost.
       ironic_inspector_auth_type: None
       ironic_inspector_auth: {}

ansible/seed-ipa-build.yml

@@ -19,6 +19,8 @@
             name: stackhpc.os-images
           vars:
             os_images_venv: "{{ virtualenv_path }}/ipa-build-dib"
+            os_images_package_state: latest
+            os_images_upper_constraints_file: "{{ pip_upper_constraints_file }}"
             os_images_cache: "{{ image_cache_path }}"
             os_images_common: ""
             os_images_list:

etc/kayobe/kolla.yml

@@ -146,6 +146,7 @@
 #kolla_openstack_logging_debug:
 
 # Upper constraints file for installation of Kolla.
+# Default value is {{ pip_upper_constraints_file }}.
 #kolla_upper_constraints_file:
 
 # User account to use for Kolla SSH access.

etc/kayobe/pip.yml

@@ -1,5 +1,10 @@
 ---
 
+# Upper constraints file for installation of python packages.
+# Default value is
+# "https://releases.openstack.org/constraints/upper/{{ openstack_branch }}"
+#pip_upper_constraints_file:
+
 # Use a local PyPi mirror for installing Pip packages
 #pip_local_mirror: false
 

playbooks/kayobe-overcloud-base/overrides.yml.j2

@@ -11,8 +11,8 @@ kolla_source_url: "{{ ansible_env.PWD ~ '/' ~ zuul.projects['opendev.org/opensta
 kolla_source_version: "{{ zuul.projects['opendev.org/openstack/kolla'].checkout }}"
 kolla_ansible_source_url: "{{ ansible_env.PWD ~ '/' ~ zuul.projects['opendev.org/openstack/kolla-ansible'].src_dir }}"
 kolla_ansible_source_version: "{{ zuul.projects['opendev.org/openstack/kolla-ansible'].checkout }}"
-kolla_upper_constraints_file: "/tmp/upper-constraints.txt"
 kolla_openstack_logging_debug: True
+pip_upper_constraints_file: "/tmp/upper-constraints.txt"
 
 # Use the CI infra's PyPI mirror.
 pip_local_mirror: true

playbooks/kayobe-overcloud-upgrade-base/overrides.yml.j2

@@ -12,7 +12,7 @@ kolla_source_url: "{{ ansible_env.PWD ~ '/' ~ zuul.projects['opendev.org/opensta
 kolla_source_version: "{{ zuul.projects['opendev.org/openstack/kolla'].checkout }}"
 kolla_ansible_source_url: "{{ ansible_env.PWD ~ '/' ~ zuul.projects['opendev.org/openstack/kolla-ansible'].src_dir }}"
 kolla_ansible_source_version: "{{ zuul.projects['opendev.org/openstack/kolla-ansible'].checkout }}"
-kolla_upper_constraints_file: "/tmp/upper-constraints.txt"
+pip_upper_constraints_file: "/tmp/upper-constraints.txt"
 {% endif %}
 kolla_openstack_logging_debug: true
 

playbooks/kayobe-seed-base/overrides.yml.j2

@@ -11,8 +11,8 @@ kolla_source_url: "{{ ansible_env.PWD ~ '/' ~ zuul.projects['opendev.org/opensta
 kolla_source_version: "{{ zuul.projects['opendev.org/openstack/kolla'].checkout }}"
 kolla_ansible_source_url: "{{ ansible_env.PWD ~ '/' ~ zuul.projects['opendev.org/openstack/kolla-ansible'].src_dir }}"
 kolla_ansible_source_version: "{{ zuul.projects['opendev.org/openstack/kolla-ansible'].checkout }}"
-kolla_upper_constraints_file: "/tmp/upper-constraints.txt"
 kolla_openstack_logging_debug: True
+pip_upper_constraints_file: "/tmp/upper-constraints.txt"
 
 # NOTE(mgoddard): We're using a cirros image, which doesn't require the
 # resolv.conf work around used for CentOS.

playbooks/kayobe-seed-upgrade-base/overrides.yml.j2

@@ -12,7 +12,7 @@ kolla_source_url: "{{ ansible_env.PWD ~ '/' ~ zuul.projects['opendev.org/opensta
 kolla_source_version: "{{ zuul.projects['opendev.org/openstack/kolla'].checkout }}"
 kolla_ansible_source_url: "{{ ansible_env.PWD ~ '/' ~ zuul.projects['opendev.org/openstack/kolla-ansible'].src_dir }}"
 kolla_ansible_source_version: "{{ zuul.projects['opendev.org/openstack/kolla-ansible'].checkout }}"
-kolla_upper_constraints_file: "/tmp/upper-constraints.txt"
+pip_upper_constraints_file: "/tmp/upper-constraints.txt"
 {% endif %}
 
 # NOTE(mgoddard): We're using a cirros image, which doesn't require the

releasenotes/notes/stale-virtualenvs-125c513af3de9396.yaml

@@ -0,0 +1,18 @@
+---
+features:
+  - |
+    Adds a new configuration variable, ``pip_upper_constraints_file``, which is
+    used to configure the file or URL containing the python upper version
+    contraints. Its default value is
+    ``https://releases.openstack.org/constraints/upper/{{ openstack_branch }}``.
+fixes:
+  - |
+    Fixes an issue with virtual environments on remote hosts, which may over
+    the course of time become stale and incompatible with Kayobe or other
+    software. This was fixed by installing the latest version of packages
+    allowed by OpenStack upper constraints. See `story 2005923
+    <https://storyboard.openstack.org/#!/story/2005923>`__ for details.
+upgrade:
+  - |
+    The default value of ``kolla_upper_constraints_file`` has been changed to
+    ``{{ pip_upper_constraints_file }}``.

requirements.yml

@@ -30,15 +30,15 @@
 - src: stackhpc.mellanox-switch
   version: v1.0.0
 - src: stackhpc.os-images
-  version: v1.2.0
+  version: v1.4.0
 - src: stackhpc.os-ironic-state
   version: v1.1.0
 - src: stackhpc.os-networks
   version: v1.1.0
 - src: stackhpc.os-openstackclient
-  version: v1.2.0
+  version: v1.3.0
 - src: stackhpc.os-shade
-  version: v1.2.0
+  version: v1.3.0
 # We are currently using a fork of this role since the upstream yatesr.timezone
 # role includes symlinks which do not play nicely with PBR. Once that issue has
 # been resolved in PBR, we can revert to using the upstream yatesr.timezone