Use upper-constraints file in developer mode

Currently, keystone fails to install in developer mode due to us not
specifying upper constraints.  This is due to an upcapped version of
pysaml2 being installed which is causing problems.  This commit first
clones the requirements repo and then uses the upper constraints file
when installing packages.

Note that we only update pip_install_options when in developer mode if
the constraints aren't already set.  This is because in developer mode
you could have a container with multiple services running on it and the
pip_install_options fact would get updated when already set, resulting
in pip failing to install packages.

Change-Id: I4f21c20a1f7fa1fc4277cdffc98fc9b2017f11d1

defaults/main.yml

@@ -17,6 +17,17 @@
 debug: False
 verbose: True
 
+# These variables are used in 'developer mode' in order to allow the role
+# to build an environment directly from a git source without the presence
+# of an OpenStack-Ansible repo_server.
+keystone_git_repo: https://git.openstack.org/openstack/keystone
+keystone_git_install_branch: master
+keystone_requirements_git_repo: https://git.openstack.org/openstack/requirements
+keystone_requirements_git_install_branch: master
+keystone_developer_mode: false
+keystone_developer_constraints:
+  - "git+{{ keystone_git_repo }}@{{ keystone_git_install_branch }}#egg=keystone"
+
 # Name of the virtual env to deploy into
 keystone_venv_tag: untagged
 keystone_venv_bin: "/openstack/venvs/keystone-{{ keystone_venv_tag }}/bin"
@@ -348,15 +359,6 @@ keystone_sp_apt_packages:
 # Keystone notification settings
 keystone_ceilometer_enabled: false
 
-# These variables are used in 'developer mode' in order to allow the role
-# to build an environment directly from a git source without the presence
-# of an OpenStack-Ansible repo_server.
-keystone_git_repo: https://git.openstack.org/openstack/keystone
-keystone_git_install_branch: master
-keystone_developer_mode: false
-keystone_developer_constraints:
-  - "git+{{ keystone_git_repo }}@{{ keystone_git_install_branch }}#egg=keystone"
-
 # Keystone packages that must be installed before anything else
 keystone_requires_pip_packages:
   - virtualenv

tasks/keystone_install.yml

@@ -32,15 +32,30 @@
     - keystone-install
     - keystone-pip-packages
 
-- name: Set constraint file fact for developer mode
-  set_fact:
-    pip_install_options: "{{ pip_install_options|default('') }} --constraint /opt/developer-pip-constraints.txt"
+- name: Clone requirements git repository
+  git:
+    repo: "{{ keystone_requirements_git_repo }}"
+    dest: "/opt/requirements"
+    clone: yes
+    update: yes
+    version: "{{ keystone_requirements_git_install_branch }}"
   when:
     - keystone_developer_mode | bool
   tags:
     - keystone-install
     - keystone-pip-packages
 
+- name: Add constraints to pip_install_options fact for developer mode
+  set_fact:
+    pip_install_options: "{{ pip_install_options|default('') }} --constraint /opt/developer-pip-constraints.txt --constraint /opt/requirements/upper-constraints.txt"
+  when:
+    - keystone_developer_mode | bool
+    - "'/opt/developer-pip-constraints.txt' not in pip_install_options|default('')"
+    - "'/opt/requirements/upper-constraints.txt' not in pip_install_options|default('')"
+  tags:
+    - keystone-install
+    - keystone-pip-packages
+
 - name: Install requires pip packages
   pip:
     name: "{{ item }}"

tests/test.yml

@@ -202,6 +202,7 @@
     keystone_venv_tag: "testing"
     keystone_developer_mode: true
     keystone_git_install_branch: a55128044f763f5cfe2fdc57c738eaca97636448
+    keystone_requirements_git_install_branch: 332278d456e06870150835564342570ec9d5f5a0
     keystone_auth_admin_token: "SuperSecreteTestToken"
     keystone_auth_admin_password: "SuperSecretePassword"
     keystone_service_password: "secrete"