Instead of sourcing the paste/policy files from the role,
the deploy host will first be checked, then the git source.
The current mechanism uses a lookup, causing the fetch of
the default templates to happen via curl from the deployment
node. This causes problems if the deployment node does not
have access to the repo server web service, which may be the
case in high security environments.
This patch changes the mechanism to only use the lookup
module for the file content that is on the deployment node,
then falls back to using the uri module to fetch the default
content. This ensures that the deployment node does not have
to reach into the environment for the content.
The pattern applied is the same as that used in the
combination of the following two reference patches:
- https://review.openstack.org/446235
- https://review.openstack.org/463390
The rootwrap.conf template is re-added because it cannot be
used verbatim from the upstream repository. It requires the
addition of the service venv bin in the exec_dirs. A mechanism
to implement this dynamically will be figured out in a later
review along with an implementation which will fetch the
rootwrap files directly from the git source too.
Conflicts:
defaults/main.yml
tasks/ceilometer_post_install.yml
Change-Id: I248910a544f611b590bc93449aea98434802cae3
(cherry picked from commit 9e96b65126)
b4fa7cfc85