diff --git a/defaults/main.yml b/defaults/main.yml index d460409..041015c 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -22,6 +22,11 @@ heat_ceilometer_enabled: False ## Verbosity Options debug: False +# Set the host which will execute the shade modules +# for the service setup. The host must already have +# clouds.yaml properly configured. +heat_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}" + # Set the package install state for distribution and pip packages # Options are 'present' and 'latest' heat_package_state: "latest" @@ -181,11 +186,6 @@ heat_plugin_dirs: # "cloudformation:ListStacks": "rule:deny_stack_user" # "cloudformation:CreateStack": "rule:deny_stack_user" -# Heat packages that must be installed before anything else -heat_requires_pip_packages: - - virtualenv - - httplib2 - # Common pip packages heat_pip_packages: - cryptography diff --git a/meta/main.yml b/meta/main.yml index 1a78126..6eeaee0 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -42,4 +42,3 @@ dependencies: when: - ansible_pkg_mgr == 'apt' - galera_client - - openstack_openrc diff --git a/releasenotes/notes/heat-service-setup-host-e15eb9aa40414697.yaml b/releasenotes/notes/heat-service-setup-host-e15eb9aa40414697.yaml new file mode 100644 index 0000000..65a7148 --- /dev/null +++ b/releasenotes/notes/heat-service-setup-host-e15eb9aa40414697.yaml @@ -0,0 +1,17 @@ +--- +features: + - | + The service setup in keystone for heat will now be executed + through delegation to the ``heat_service_setup_host`` which, + by default, is ``localhost`` (the deploy host). Deployers can + opt to rather change this to the utility container by implementing + the following override in ``user_variables.yml``. + + .. code-block:: yaml + + heat_service_setup_host: "{{ groups['utility_all'][0] }}" + +deprecations: + - | + The variable ``heat_requires_pip_packages`` is no longer required + and has therefore been removed. diff --git a/tasks/heat_install_source.yml b/tasks/heat_install_source.yml index b347234..ad7a9cf 100644 --- a/tasks/heat_install_source.yml +++ b/tasks/heat_install_source.yml @@ -22,19 +22,6 @@ {% endfor %} when: heat_developer_mode | bool -- name: Install requires pip packages - pip: - name: "{{ heat_requires_pip_packages }}" - state: "{{ heat_pip_package_state }}" - extra_args: >- - {{ heat_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }} - {{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }} - {{ pip_install_options | default('') }} - register: install_packages - until: install_packages|success - retries: 5 - delay: 2 - - name: Retrieve checksum for venv download uri: url: "{{ heat_venv_download_url | replace('tgz', 'checksum') }}" diff --git a/tasks/heat_service_add.yml b/tasks/heat_service_add.yml deleted file mode 100644 index bb829ef..0000000 --- a/tasks/heat_service_add.yml +++ /dev/null @@ -1,95 +0,0 @@ ---- -# Copyright 2014, Rackspace US, Inc. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Create a service -- name: Ensure heat service - keystone: - command: "ensure_service" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - service_name: "{{ service_name }}" - service_type: "{{ service_type }}" - description: "{{ service_description }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - until: add_service|success - retries: 5 - delay: 10 - no_log: True - -# Create an admin user -- name: Ensure heat user - keystone: - command: "ensure_user" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - user_name: "{{ heat_service_user_name }}" - tenant_name: "{{ heat_service_project_name }}" - password: "{{ heat_service_password }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - when: not heat_service_in_ldap | bool - until: add_service|success - retries: 5 - delay: 10 - no_log: True - -# Add a role to the user -- name: Ensure heat user to admin role - keystone: - command: "ensure_user_role" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - user_name: "{{ heat_service_user_name }}" - tenant_name: "{{ heat_service_project_name }}" - role_name: "{{ heat_service_role_name }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - when: not heat_service_in_ldap | bool - until: add_service|success - retries: 5 - delay: 10 - no_log: True - -# Create an endpoint -- name: Ensure heat endpoint - keystone: - command: "ensure_endpoint" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - region_name: "{{ heat_service_region }}" - service_name: "{{ service_name }}" - service_type: "{{ service_type }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - endpoint_list: - - url: "{{ service_publicurl }}" - interface: "public" - - url: "{{ service_internalurl }}" - interface: "internal" - - url: "{{ service_adminurl }}" - interface: "admin" - register: add_service - until: add_service|success - retries: 5 - delay: 10 - no_log: True diff --git a/tasks/heat_service_setup.yml b/tasks/heat_service_setup.yml index ebdb4c2..2714c62 100644 --- a/tasks/heat_service_setup.yml +++ b/tasks/heat_service_setup.yml @@ -1,5 +1,5 @@ --- -# Copyright 2014, Rackspace US, Inc. +# Copyright 2016, Rackspace US, Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -13,58 +13,120 @@ # See the License for the specific language governing permissions and # limitations under the License. -- include: heat_service_add.yml +# We set the python interpreter to the ansible runtime venv if +# the delegation is to localhost so that we get access to the +# appropriate python libraries in that venv. If the delegation +# is to another host, we assume that it is accessible by the +# system python instead. +- name: Setup the service + delegate_to: "{{ heat_service_setup_host }}" vars: - service_name: "{{ heat_service_name }}" - service_type: "{{ heat_service_type }}" - service_description: "{{ heat_service_description }}" - service_publicurl: "{{ heat_service_publicurl }}" - service_internalurl: "{{ heat_service_internalurl }}" - service_adminurl: "{{ heat_service_adminurl }}" + ansible_python_interpreter: >- + {{ (heat_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_python['executable']) }} + block: + - name: Add service to the keystone service catalog + os_keystone_service: + cloud: default + state: present + name: "{{ item.name }}" + service_type: "{{ item.service_type }}" + description: "{{ item.description }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + until: add_service is success + retries: 5 + delay: 10 + with_items: + - name: "{{ heat_service_name }}" + service_type: "{{ heat_service_type }}" + description: "{{ heat_service_description }}" + - name: "{{ heat_cfn_service_name }}" + service_type: "{{ heat_cfn_service_type }}" + description: "{{ heat_cfn_service_description }}" + loop_control: + label: "{{ item.name }}" -- include: heat_service_add.yml - vars: - service_name: "{{ heat_cfn_service_name }}" - service_type: "{{ heat_cfn_service_type }}" - service_description: "{{ heat_cfn_service_description }}" - service_publicurl: "{{ heat_cfn_service_publicurl }}" - service_internalurl: "{{ heat_cfn_service_internalurl }}" - service_adminurl: "{{ heat_cfn_service_adminurl }}" + - name: Add service user + os_user: + cloud: default + state: present + name: "{{ heat_service_user_name }}" + password: "{{ heat_service_password }}" + domain: default + default_project: "{{ heat_service_project_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + when: not heat_service_in_ldap | bool + until: add_service is success + retries: 5 + delay: 10 + no_log: True -# We add the keystone role used by heat to delegate to the heat service user -# (for performing deferred operations via trusts) -- name: Ensure stack_owner role - keystone: - command: "ensure_role" - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - user_name: "{{ heat_service_user_name }}" - tenant_name: "{{ heat_service_project_name }}" - role_name: "{{ heat_stack_owner_name }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - until: add_service|success - retries: 5 - delay: 10 - no_log: True + - name: Ensure stack_owner role + os_keystone_role: + cloud: default + state: present + name: "{{ heat_stack_owner_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + when: not heat_service_in_ldap | bool + until: add_service is success + retries: 5 + delay: 10 -# Any user creating stacks needs to have the 'heat_stack_owner' role assigned, -# we add to admin user here for testing purposes -- name: Ensure admin has stack_owner role - keystone: - command: ensure_user_role - endpoint: "{{ keystone_service_adminurl }}" - login_user: "{{ keystone_admin_user_name }}" - login_password: "{{ keystone_auth_admin_password }}" - login_project_name: "{{ keystone_admin_tenant_name }}" - user_name: "{{ keystone_admin_user_name }}" - tenant_name: "{{ keystone_admin_tenant_name }}" - role_name: "{{ heat_stack_owner_name }}" - insecure: "{{ keystone_service_adminuri_insecure }}" - register: add_service - until: add_service|success - retries: 5 - delay: 10 - no_log: True + - name: Add service user to roles + os_user_role: + cloud: default + state: present + user: "{{ item.user }}" + role: "{{ item.role }}" + project: "{{ heat_service_project_name }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + when: not heat_service_in_ldap | bool + until: add_service is success + retries: 5 + delay: 10 + with_items: + - user: "{{ heat_service_user_name }}" + role: "{{ heat_service_role_name }}" + # We add the keystone role used by heat to delegate to the heat service user + # for performing deferred operations via trusts. + - user: "{{ heat_service_user_name }}" + role: "{{ heat_stack_owner_name }}" + # Any user creating stacks needs to have the 'heat_stack_owner' role assigned. + # We add to admin user here for testing purposes. + - user: "{{ keystone_admin_user_name }}" + role: "{{ heat_stack_owner_name }}" + + - name: Add endpoints to keystone endpoint catalog + os_keystone_endpoint: + cloud: default + state: present + service: "{{ heat_service_name }}" + endpoint_interface: "{{ item.interface }}" + url: "{{ item.url }}" + region: "{{ heat_service_region }}" + endpoint_type: admin + verify: "{{ not keystone_service_adminuri_insecure }}" + register: add_service + until: add_service is success + retries: 5 + delay: 10 + with_items: + - interface: "public" + url: "{{ heat_service_publicurl }}" + - interface: "internal" + url: "{{ heat_service_internalurl }}" + - interface: "admin" + url: "{{ heat_service_adminurl }}" + - interface: "public" + url: "{{ heat_cfn_service_publicurl }}" + - interface: "internal" + url: "{{ heat_cfn_service_internalurl }}" + - interface: "admin" + url: "{{ heat_cfn_service_adminurl }}" diff --git a/tests/host_vars/localhost.yml b/tests/host_vars/localhost.yml index 65ddeaa..6c26f31 100644 --- a/tests/host_vars/localhost.yml +++ b/tests/host_vars/localhost.yml @@ -15,5 +15,3 @@ bridges: - "br-mgmt" - -ansible_python_interpreter: "/usr/bin/python2"