openstack-ansible-os_keystone/tasks/keystone_install.yml

---
# Copyright 2014, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

- name: Create keystone dir
  file:
    path: "{{ item.path }}"
    state: directory
    owner: "{{ item.owner | default(keystone_system_user_name) }}"
    group: "{{ item.group | default(keystone_system_group_name) }}"
    mode: "{{ item.mode | default('0755') }}"
  with_items:
    - { path: "/var/lock/keystone", mode: "2755" }
    - { path: "/var/log/httpd", mode: "2755" }
  when:
    - ansible_facts['pkg_mgr'] == 'dnf'

- name: Create system links
  file:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    state: "link"
  with_items:
    - { src: "/var/log/httpd", dest: "/var/log/apache2" }
  when:
    - ansible_facts['pkg_mgr'] == 'dnf'

- name: Add shibboleth repo
  yum_repository:
    name: "shibboleth"
    description: "shibboleth Repo"
    baseurl: "{{ keystone_centos_shibboleth_mirror }}"
    gpgkey: "{{ keystone_centos_shibboleth_key }}"
    gpgcheck: yes
  when:
    - ansible_facts['pkg_mgr'] == 'dnf'
    - keystone_sp != {}

- name: Install distro packages
  package:
    name: "{{ keystone_package_list }}"
    state: "{{ keystone_package_state }}"
    update_cache: "{{ (ansible_facts['pkg_mgr'] == 'apt') | ternary('yes', omit) }}"
    cache_valid_time: "{{ (ansible_facts['pkg_mgr'] == 'apt') | ternary(cache_timeout, omit) }}"
  register: install_packages
  until: install_packages is success
  retries: 5
  delay: 2
  notify:
    - Restart web server
    - Restart uWSGI

- name: Install/remove apache mod packages for federated authentication
  package:
    name: "{{ item.name }}"
    state: "{{ item.state }}"
  with_items: "{{ keystone_sp_apache_mod_packages }}"

- name: Install the python venv
  import_role:
    name: "python_venv_build"
  vars:
    venv_python_executable: "{{ keystone_venv_python_executable }}"
    venv_build_constraints: "{{ keystone_git_constraints }}"
    venv_build_distro_package_list: "{{ keystone_devel_distro_packages }}"
    venv_install_destination_path: "{{ keystone_bin | dirname }}"
    venv_pip_install_args: "{{ keystone_pip_install_args }}"
    venv_pip_packages: >-
      {{ keystone_pip_packages |
           union(keystone_user_pip_packages) |
             union(((keystone_oslomsg_amqp1_enabled | bool) | ternary(keystone_optional_oslomsg_amqp1_pip_packages, []))) }}      
    venv_facts_when_changed:
      - section: "keystone"
        option: "need_db_expand"
        value: "True"
      - section: "keystone"
        option: "need_db_migrate"
        value: "True"
      - section: "keystone"
        option: "need_db_contract"
        value: "True"
      - section: "keystone"
        option: "venv_tag"
        value: "{{ keystone_venv_tag }}"
      - section: "keystone"
        option: "install_method"
        value: "{{ keystone_install_method }}"
  when: keystone_install_method == 'source'

# TODO(hwoarang): We need to have a venv_tag local fact deployed since we use it in the
# integration repo to determine if keystone software is the same across all nodes in the
# keystone_all group so we can safely run the DB migration. See
# https://github.com/openstack/openstack-ansible/blob/master/playbooks/os-keystone-install.yml
- name: Record local facts for distro path
  when: keystone_install_method == 'distro'
  block:
    - name: Record the osa version deployed
      ini_file:
        dest: "/etc/ansible/facts.d/openstack_ansible.fact"
        section: keystone
        option: venv_tag
        value: "{{ keystone_venv_tag }}"
        mode: "0644"

    # NOTE(noonedeadpunk): Ubuntu packages does recursively chmod all files
    #                      for keystone user $HOME:
    #                      https://bugs.launchpad.net/cloud-archive/+bug/2060235
    - name: Ensure SSH keys has right permissions
      file:
        path: "{{ keystone_system_user_home }}/.ssh/id_rsa"
        mode: "0600"
      when:
        - install_packages is changed
        - ansible_facts['distribution'] | lower == 'ubuntu'

    - name: Initialise the upgrade facts
      ini_file:
        dest: "/etc/ansible/facts.d/openstack_ansible.fact"
        section: keystone
        option: "{{ item.name }}"
        value: "{{ item.state }}"
        mode: "0644"
      with_items:
        - name: "need_db_expand"
          state: "True"
        - name: "need_db_migrate"
          state: "True"
        - name: "need_db_contract"
          state: "True"
        - name: "install_method"
          state: "{{ keystone_install_method }}"
      when: (install_packages is changed) or
            (ansible_local is not defined) or
            ('openstack_ansible' not in ansible_local) or
            ('keystone' not in ansible_local['openstack_ansible']) or
            ('need_db_expand' not in ansible_local['openstack_ansible']['keystone']) or
            ('need_db_migrate' not in ansible_local['openstack_ansible']['keystone']) or
            ('need_db_contract' not in ansible_local['openstack_ansible']['keystone'])

- name: Create WSGI symlinks
  file:
    src: "{{ keystone_bin }}/keystone-wsgi-public"
    dest: "/var/www/cgi-bin/keystone/main"
    state: link
    force: yes
  notify:
    - Restart web server