CI: make it work again

Python changes:
- limit pip to 20.x as this is last version working on both Python 2 and 3.
- cap 'setuptools' to be older than 58 to have use_2to3 functionality
  (fixes 'anyjson' installation)
- upgrade pip in 'elasticsearch-curator' image to get it built on CentOS 7

Unbuildable images:
- 'bifrost-base' under CentOS 8
  (Error: Cannot find a valid baseurl for repo: epel)
- 'monasca-grafana' under CentOS 7/8
- 'sensu-client' under CentOS 7
  (aws-eventstream requires Ruby version >= 2.3)

- dropped *-upgrade CI jobs as Stein is EOL

- pin 'qpid-proton-c' package for CentOS 7 to not install EPEL one
  (cinder-volume, openstack-base and tripleoclient)

- bump 'libvirt-python' in 'masakari-monitors' to 7.10.0
  (newer branches install package from distribution but CentOS 7 lacks
  it)

- pin 'unf_ext' gem in Sensu images as CentOS 7 lacks Ruby 2.2+
  (fixed sensu-server)

- install 'ca-certificates' for newer Let's Encrypt certificates support
  (so we can fetch upper-constraints)

- make Zuul fetch openstack/requirements project files
   (make 'openstack-base' pass) (like 2nd fix)

Co-Authored-by: Pierre Riteau <pierre@stackhpc.com>
Closes-Bug: #1943617
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/826464

Change-Id: I8ee32e53cda581493b2a4bb73ca72ab05014b9d4

.zuul.d/base.yaml

@@ -64,8 +64,11 @@
       - ^contrib/
       - ^LICENSE$
       - ^tox\.ini$
+    required-projects:
+      - name: openstack/requirements
     vars:
       publisher: false
+      requirements_src_dir: "{{ ansible_env.PWD ~ '/' ~ zuul.projects['opendev.org/openstack/requirements'].src_dir }}"
     extra-vars:
       kolla_logs_dir: "{{ zuul_output_dir }}/logs/kolla"
       kolla_build_logs_dir: "{{ kolla_logs_dir }}/build"

.zuul.d/centos.yaml

@@ -8,7 +8,6 @@
         - kolla-build-centos8-source
         - kolla-ansible-centos-source
         - kolla-ansible-centos-binary
-        - kolla-ansible-centos-source-upgrade
         - tripleo-build-containers-centos-7:
             voting: true
             files:
@@ -23,7 +22,6 @@
         - kolla-build-centos-source
         - kolla-build-centos8-source
         - kolla-ansible-centos-source
-        - kolla-ansible-centos-source-upgrade
         - tripleo-build-containers-centos-7:
             voting: true
             files:
@@ -51,8 +49,6 @@
         # Test rabbitmq & mariadb changes in multinode ceph jobs.
         - kolla-ansible-centos-source-ceph:
             files: ^docker\/(base|ceph|cinder|glance|mariadb|openstack-base|rabbitmq)\/.*
-        - kolla-ansible-centos-source-upgrade-ceph:
-            files: ^docker\/(base|ceph|cinder|glance|mariadb|openstack-base|rabbitmq)\/.*
         - kolla-ansible-centos-source-zun:
             files: ^docker\/(base|cinder|etcd|iscsid|kuryr|openstack-base|zun)\/.*
         - kolla-ansible-centos-source-scenario-nfv:

.zuul.d/ubuntu.yaml

@@ -6,13 +6,11 @@
         - kolla-build-ubuntu-source
         - kolla-ansible-ubuntu-source
         - kolla-ansible-ubuntu-binary
-        - kolla-ansible-ubuntu-source-upgrade
     gate:
       queue: kolla
       jobs:
         - kolla-build-ubuntu-source
         - kolla-ansible-ubuntu-source
-        - kolla-ansible-ubuntu-source-upgrade
     periodic-weekly:
       jobs:
         - kolla-publish-ubuntu-source
@@ -26,8 +24,6 @@
         # Test rabbitmq and mariadb in multinode ceph jobs.
         - kolla-ansible-ubuntu-source-ceph:
             files: ^docker\/(base|ceph|cinder|glance|mariadb|openstack-base|rabbitmq)\/.*
-        - kolla-ansible-ubuntu-source-upgrade-ceph:
-            files: ^docker\/(base|ceph|cinder|glance|mariadb|openstack-base|rabbitmq)\/.*
         - kolla-ansible-ubuntu-source-zun:
             files: ^docker\/(base|cinder|etcd|iscsid|kuryr|openstack-base|zun)\/.*
         - kolla-ansible-ubuntu-source-ironic:

docker/cinder/cinder-volume/Dockerfile.j2

@@ -18,9 +18,11 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
             'python3-cinderlib',
     ] %}
     {% else %}
+    {# NOTE(hrw): qpid-proton-c 0.26 from centos-openstack-train repo instead of epel #}
     {% set cinder_volume_packages = cinder_volume_packages + [
             'python-rtslib',
             'python2-cinderlib',
+            'qpid-proton-c-0.26.*',
     ] %}
     {% endif %}
 {{ macros.install_packages(cinder_volume_packages | customizable("packages")) }}

docker/elasticsearch/elasticsearch-curator/Dockerfile.j2

@@ -27,7 +27,9 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
     'elasticsearch-curator'
 ] %}
 
-RUN {{ macros.install_pip(elasticsearch_curator_pip_packages | customizable("pip_packages"), constraints=false) }} \
+# NOTE(hrw): CentOS 7 has pip 8 which fails to handle boto3/botocore requirements of elasticsearch-curator
+RUN {{ macros.install_pip(['pip==20.*'], constraints=false) }} \
+    && {{ macros.install_pip(elasticsearch_curator_pip_packages | customizable("pip_packages"), constraints=false) }} \
     && mkdir -p /etc/elasticsearch-curator \
     && chown -R elasticsearch: /etc/elasticsearch-curator
 

docker/masakari/masakari-monitors/Dockerfile.j2

@@ -41,7 +41,7 @@ ADD masakari-monitors-archive /masakari-monitors-source
 ] %}
 
 RUN ln -s masakari-monitors-source/* masakari-monitors \
-    {% if distro_package_manager == 'dnf' %}&& sed -i -e 's/libvirt-python===.*/libvirt-python===6.10.0/' /requirements/upper-constraints.txt {% endif %}\
+    {% if distro_package_manager == 'dnf' %}&& sed -i -e 's/libvirt-python===.*/libvirt-python===7.10.0/' /requirements/upper-constraints.txt {% endif %}\
     && {{ macros.install_pip(masakari_monitors_pip_packages | customizable("pip_packages")) }} \
     && mkdir -p /etc/masakari-monitors \
     && chown -R masakari: /etc/masakari-monitors

docker/openstack-base/Dockerfile.j2

@@ -96,6 +96,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
             'python3-zaqarclient',
         ] %}
         {% else %}
+        {# NOTE(hrw): qpid-proton-c 0.26 from centos-openstack-train repo instead of epel #}
         {% set openstack_base_packages = openstack_base_packages + [
             'python2-cryptography',
             'python2-eventlet',
@@ -173,6 +174,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
             'python2-webob',
             'python-zaqarclient',
             'PyYAML',
+            'qpid-proton-c-0.26.*',
             'sysvinit-tools'
         ] %}
         {% endif %}
@@ -410,7 +412,9 @@ RUN ln -s openstack-base-source/* /requirements \
 
 ENV PATH /var/lib/kolla/venv/bin:$PATH
 
-RUN {{ macros.install_pip(openstack_base_pip_packages | customizable("pip_packages")) }}
+{# NOTE(hrw): setuptools is capped in openstack/requirements as this version still has use_2to3 #}
+RUN {{ macros.install_pip(["'setuptools < 58'"]) }} \
+ && {{ macros.install_pip(openstack_base_pip_packages | customizable("pip_packages")) }}
 
 {% endif %}
 

docker/sensu/sensu-client/Dockerfile.j2

@@ -89,7 +89,8 @@ RUN echo '{{ image_name }} not yet available for {{ base_distro }}' \
 # NOTE(hrw): whois 5.0.0 requires Ruby 2.4+ while CentOS has 2.0
 # NOTE(yoctozepto): pinning minitest for the same reason
 # NOTE(yoctozepto): pinning simpleidn because it started requiring Ruby 2.2
-RUN {%if base_package_type == 'rpm' %} gem install whois:"<5" minitest:"~>5.11.3" simpleidn:"~>0.1.1" && {% endif %} sensu-install --plugins {{ sensu_plugins | customizable('plugins') | join (',') }}
+# NOTE(hrw): gem order is crucial - simpleidn depends on unf_ext
+RUN {%if base_package_type == 'rpm' %} gem install whois:"<5" minitest:"~>5.11.3" unf_ext:"<0.0.7.7" simpleidn:"~>0.1.1" && {% endif %} sensu-install --plugins {{ sensu_plugins | customizable('plugins') | join (',') }}
 {% endblock %}
 
 {% block sensu_client_footer %}{% endblock %}

docker/sensu/sensu-server/Dockerfile.j2

@@ -31,7 +31,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
     'slack:"~>3"'
 ] %}
 
-RUN sensu-install --plugins {{ sensu_plugins | customizable('plugins') | join (',') }}
+RUN {%if base_package_type == 'rpm' %} gem install unf_ext:"<0.0.7.7" && {% endif %} sensu-install --plugins {{ sensu_plugins | customizable('plugins') | join (',') }}
 {% endblock %}
 
 {% block sensu_server_footer %}{% endblock %}

docker/tripleoclient/Dockerfile.j2

@@ -22,10 +22,12 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
                 'python3-tripleoclient'
         ] %}
         {% else %}
+        {# NOTE(hrw): qpid-proton-c 0.26 from centos-openstack-train repo instead of epel #}
         {% set tripleoclient_packages = tripleoclient_packages + [
                 'python-ipaddr',
                 'python-openstackclient',
-                'python-tripleoclient'
+                'python-tripleoclient',
+                'qpid-proton-c-0.26.*'
         ] %}
         {% endif %}
 

kolla/image/build.py

@@ -143,8 +143,10 @@ UNBUILDABLE_IMAGES = {
     },
 
     'centos': {
+        "monasca-grafana",       # Does not build
         "mongodb",
         "ovsdpdk",
+        "sensu-client",          # aws-eventstream requires Ruby version >= 2.3
     },
 
     # NOTE(mgoddard): Mark images with missing dependencies as unbuildable for
@@ -161,6 +163,7 @@ UNBUILDABLE_IMAGES = {
         "kube-base",             # Dropped in master
         "kubernetes-entrypoint",  # Dropped in master
         "kubetoolbox",           # Dropped in master
+        "monasca-grafana",       # Does not build
         "mongodb",               # Missing mongodb and mongodb-server packages
         "nova-spicehtml5proxy",  # Missing spicehtml5 package
         "opendaylight",          # Missing opendaylight repo
@@ -171,6 +174,7 @@ UNBUILDABLE_IMAGES = {
     },
 
     'centos8+source': {
+        "bifrost-base",          # Cannot find a valid baseurl for repo: epel
         "cyborg-agent",          # opae-sdk does not support CentOS 8
     },
 

tests/playbooks/pre.yml

@@ -44,6 +44,12 @@
           - python-wheel
           - python-virtualenv
 
+    - name: Install CA certificates (to have up-to-date Let's Encrypt support)
+      become: true
+      package:
+        name:
+          - ca-certificates
+
     - name: Install virtualenv on Debian systems
       # NOTE(hrw): On RedHat systems it is part of python3-virtualenv
       package:
@@ -57,7 +63,7 @@
       # NOTE(mnasiadka): pip 8.x delivered with EPEL has problems installing
       # zipp and configparser
       become: true
-      command: "pip install --upgrade pip"
+      command: "pip install --upgrade pip==20.*"
 
     - name: Ensure tox is installed
       pip:

tests/playbooks/run.yml

@@ -32,7 +32,14 @@
         src: "{{ zuul.executor.work_root }}/{{ zuul.project.src_dir }}/tests/templates/template_overrides.j2"
         dest: /etc/kolla/template_overrides.j2
 
+    # NOTE(hrw) REQUESTS_CA_BUNDLE is to get Let's Encrypt certificates trusted
     - name: Run tox
-      command: "{{ ansible_user_dir }}/tox-venv/bin/tox -e {{ action }}-{{ base_distro }}{{ base_tag | default('') }}-{{ install_type }}"
+      shell: |
+        if [ 'RedHat' == '{{ ansible_os_family }}' ]; then
+            export REQUESTS_CA_BUNDLE="/etc/pki/tls/certs/ca-bundle.crt"
+        fi
+        {{ ansible_user_dir }}/tox-venv/bin/tox -e {{ action }}-{{ base_distro }}{{ base_tag | default('') }}-{{ install_type }}
       args:
         chdir: "{{ zuul.project.src_dir }}"
+      environment:
+        UPPER_CONSTRAINTS_FILE: "{{ requirements_src_dir }}/upper-constraints.txt"