Openstack Ansible panko service role created

2018-01-05 14:59:49 +03:00 · 2018-01-05 14:59:49 +03:00 · 0afd4d81e4
parent 491fabf61d
commit 0afd4d81e4
42 changed files with 2138 additions and 0 deletions
--- a/CONTRIBUTING.rst
+++ b/CONTRIBUTING.rst
@ -0,0 +1,83 @@
+OpenStack panko
+##############
+
+contributor guidelines
+^^^^^^^^^^^^^^^^^^^^^^
+
+Filing Bugs
+-----------
+
+Bugs should be filed on Launchpad, not GitHub: "https://bugs.launchpad.net/openstack-ansible"
+
+
+When submitting a bug, or working on a bug, please ensure the following criteria are met:
+    * The description clearly states or describes the original problem or root cause of the problem.
+    * Include historical information on how the problem was identified.
+    * Any relevant logs are included.
+    * The provided information should be totally self-contained. External access to web services/sites should not be needed.
+    * Steps to reproduce the problem if possible.
+
+
+Submitting Code
+---------------
+
+Changes to the project should be submitted for review via the Gerrit tool, following
+the workflow documented at: "http://docs.openstack.org/infra/manual/developers.html#development-workflow"
+
+Pull requests submitted through GitHub will be ignored and closed without regard.
+
+
+Extra
+-----
+
+Tags:
+    If it's a bug that needs fixing in a branch in addition to Master, add a '\<release\>-backport-potential' tag (eg ``juno-backport-potential``).  There are predefined tags that will autocomplete.
+
+Status:
+    Please leave this alone, it should be New till someone triages the issue.
+
+Importance:
+    Should only be touched if it is a Blocker/Gating issue. If it is, please set to High, and only use Critical if you have found a bug that can take down whole infrastructures.
+
+
+Style guide
+-----------
+
+When creating tasks and other roles for use in Ansible please create then using the YAML dictionary format.
+
+Example YAML dictionary format:
+    .. code-block:: yaml
+
+        - name: The name of the tasks
+          module_name:
+            thing1: "some-stuff"
+            thing2: "some-other-stuff"
+          tags:
+            - some-tag
+            - some-other-tag
+
+
+Example **NOT** in YAML dictionary format:
+    .. code-block:: yaml
+
+        - name: The name of the tasks
+          module_name: thing1="some-stuff" thing2="some-other-stuff"
+          tags:
+            - some-tag
+            - some-other-tag
+
+
+Usage of the ">" and "|" operators should be limited to Ansible conditionals and command modules such as the ansible ``shell`` module.
+
+
+Issues
+------
+
+When submitting an issue, or working on an issue please ensure the following criteria are met:
+    * The description clearly states or describes the original problem or root cause of the problem.
+    * Include historical information on how the problem was identified.
+    * Any relevant logs are included.
+    * If the issue is a bug that needs fixing in a branch other than Master, add the ‘backport potential’ tag TO THE ISSUE (not the PR).
+    * The provided information should be totally self-contained. External access to web services/sites should not be needed.
+    * If the issue is needed for a hotfix release, add the 'expedite' label.
+    * Steps to reproduce the problem if possible.
--- a/202
+++ b/202
@ -0,0 +1,202 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
--- a/README.rst
+++ b/README.rst
@ -0,0 +1,60 @@
+========================
+Team and repository tags
+========================
+
+.. image:: http://governance.openstack.org/badges/openstack-ansible-os_panko.svg
+    :target: http://governance.openstack.org/reference/tags/index.html
+
+.. Change things from this point on
+
+OpenStack panko
+##############
+
+Ansible role that installs and configures OpenStack panko as the alarm
+functionality of Telemetry.
+
+This role will install the following:
+    * panko-api
+    * panko-listener
+    * panko-evaluator
+    * panko-notifier
+
+The role will configure panko to use MongoDB for data storage, but does
+not install or configure MongoDB.
+
+Default Variables
+=================
+
+.. literalinclude:: ../../defaults/main.yml
+   :language: yaml
+   :start-after: under the License.
+
+Required Variables
+==================
+
+To use this role, define the following variables:
+
+.. code-block:: yaml
+
+   # Needed for panko to talk to MongoDB
+   panko_container_db_password: "secrete"
+   # Password used for Keystone panko service user
+   panko_service_password: "secrete"
+   # Needed for panko to talk to memcached
+   memcached_servers: 127.0.0.1
+   memcached_encryption_key: "some_key"
+   # Needed for panko to locate and connect to the RabbitMQ cluster
+   panko_rabbitmq_password: "secrete"
+   rabbitmq_servers: "10.100.100.2"
+   rabbitmq_use_ssl: true
+   rabbitmq_port: 5671
+   # Needed to setup the panko service in Keystone
+   keystone_admin_user_name: admin
+   keystone_admin_tenant_name: admin
+   keystone_auth_admin_password: "SuperSecretePassword"
+   keystone_service_adminuri_insecure: false
+   keystone_service_internaluri_insecure: false
+   keystone_service_internaluri: "http://1.2.3.4:5000"
+   keystone_service_internalurl: "{{ keystone_service_internaluri }}/v3"
+   keystone_service_adminuri: "http://5.6.7.8:35357"
+   keystone_service_adminurl: "{{ keystone_service_adminuri }}/v3"
--- a/47
+++ b/47
@ -0,0 +1,47 @@
+# Note:
+# This file is maintained in the openstack-ansible-tests repository.
+# https://git.openstack.org/cgit/openstack/openstack-ansible-tests/tree/Vagrantfile
+#
+# If you need to perform any change on it, you should modify the central file,
+# then, an OpenStack CI job will propagate your changes to every OSA repository
+# since every repo uses the same Vagrantfile
+
+# Verify whether required plugins are installed.
+required_plugins = [ "vagrant-disksize" ]
+required_plugins.each do |plugin|
+  if not Vagrant.has_plugin?(plugin)
+    raise "The vagrant plugin #{plugin} is required. Please run `vagrant plugin install #{plugin}`"
+  end
+end
+
+Vagrant.configure(2) do |config|
+  config.vm.provider "virtualbox" do |v|
+    v.memory = 4096
+    v.cpus = 2
+  end
+
+  config.vm.provision "shell",
+      privileged: false,
+      inline: <<-SHELL
+          cd /vagrant
+         ./run_tests.sh
+      SHELL
+
+  config.vm.define "ubuntu1604" do |xenial|
+    xenial.disksize.size = "40GB"
+    xenial.vm.box = "ubuntu/xenial64"
+  end
+
+  config.vm.define "opensuse422" do |leap422|
+    leap422.vm.box = "opensuse/openSUSE-42.2-x86_64"
+  end
+
+  config.vm.define "opensuse423" do |leap423|
+    leap423.vm.box = "opensuse/openSUSE-42.3-x86_64"
+  end
+
+  config.vm.define "centos7" do |centos7|
+    centos7.vm.box = "centos/7"
+  end
+
+end
--- a/bindep.txt
+++ b/bindep.txt
@ -0,0 +1,65 @@
+# This file facilitates OpenStack-CI package installation
+# before the execution of any tests.
+#
+# See the following for details:
+#  - http://docs.openstack.org/infra/bindep/
+#  - https://git.openstack.org/cgit/openstack-infra/bindep
+#
+# Even if the role does not make use of this facility, it
+# is better to have this file empty, otherwise OpenStack-CI
+# will fall back to installing its default packages which
+# will potentially be detrimental to the tests executed.
+#
+# Note:
+# This file is maintained in the openstack-ansible-tests repository.
+# https://git.openstack.org/cgit/openstack/openstack-ansible-tests/tree/bindep.txt
+# If you need to remove or add extra dependencies, you should modify
+# the central file instead and once your change is accepted then update
+# this file as well. The purpose of this file is to ensure that Python and
+# Ansible have all their necessary binary requirements on the test host before
+# tox executes. Any binary requirements needed by services/roles should be
+# installed by those roles in their applicable package install tasks, not through
+# using this file.
+#
+
+# Base requirements for Ubuntu
+gcc               [platform:dpkg]
+git-core          [platform:dpkg]
+libssl-dev        [platform:dpkg]
+libffi-dev        [platform:dpkg]
+python2.7         [platform:dpkg]
+python-apt        [platform:dpkg]
+python-dev        [platform:dpkg]
+python3           [platform:dpkg]
+python3-apt       [platform:dpkg]
+python3-dev       [platform:dpkg]
+
+# Base requirements for RPM distros
+gcc               [platform:rpm]
+gcc-c++           [platform:rpm]
+git               [platform:rpm]
+libffi-devel      [platform:rpm !platform:opensuseproject-42]
+libffi-devel-gcc5 [platform:opensuseproject-42]
+openssl-devel     [platform:redhat]
+libopenssl-devel  [platform:suse]
+python-devel      [platform:rpm]
+python2-dnf       [platform:fedora]
+
+# For SELinux
+libselinux-python [platform:redhat]
+libsemanage-python [platform:redhat]
+
+# For SSL SNI support
+python-pyasn1               [platform:dpkg platform:suse]
+python-openssl              [platform:dpkg]
+python-ndg-httpsclient      [platform:ubuntu !platform:ubuntu-14]
+python2-pyasn1              [platform:redhat]
+pyOpenSSL                   [platform:redhat]
+python-pyOpenSSL            [platform:opensuseproject-42]
+python2-pyOpenSSL           [platform:suse !platform:opensuseproject-42]
+python-ndg_httpsclient      [platform:redhat !platform:fedora]
+python2-ndg_httpsclient     [platform:fedora]
+python-ndg-httpsclient      [platform:suse]
+
+# Required for compressing collected log files in CI
+gzip
--- a/defaults/main.yml
+++ b/defaults/main.yml
@ -0,0 +1,137 @@
+---
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+## Verbosity Options
+debug: False
+
+# Set the package install state for distribution and pip packages
+# Options are 'present' and 'latest'
+panko_package_state: "latest"
+panko_pip_package_state: "latest"
+
+## Toggle developer mode
+panko_developer_mode: false
+
+## The git source/branch
+panko_git_repo: https://git.openstack.org/openstack/panko
+panko_git_install_branch: stable/pike
+
+## The packages to build from source (used in developer mode)
+panko_developer_constraints:
+  - "git+{{ panko_git_repo }}@{{ panko_git_install_branch }}#egg=panko"
+
+# Name of the virtual env to deploy into
+panko_venv_tag: untagged
+panko_bin: "/openstack/venvs/panko-{{ panko_venv_tag }}/bin"
+
+# venv_download, even when true, will use the fallback method of building the
+# venv from scratch if the venv download fails.
+panko_venv_download: "{{ not panko_developer_mode | bool }}"
+# URL of the pre-built virtualenv
+panko_venv_download_url: http://127.0.0.1/venvs/untagged/ubuntu/panko.tgz
+
+## System info
+panko_system_user_name: panko
+panko_system_group_name: panko
+panko_system_shell: /bin/false
+panko_system_comment: panko system user
+panko_system_user_home: "/var/lib/{{ panko_system_user_name }}"
+
+## DB info
+panko_database_name: panko
+panko_database_user: panko
+panko_db_type: "mysql+pymysql"
+panko_db_address: localhost
+panko_connection_string: "{{ panko_db_type }}://{{ panko_database_user }}:{{ panko_container_db_password }}@{{ panko_db_address }}/{{ panko_database_name }}?charset=utf8"
+
+
+## Apache setup
+panko_apache_log_level: info
+panko_apache_servertokens: "Prod"
+panko_apache_serversignature: "Off"
+panko_wsgi_threads: 10
+panko_wsgi_processes_max: 16
+panko_wsgi_processes: "{{ [[ansible_processor_vcpus|default(1), 1] | max * 2, panko_wsgi_processes_max] | min }}"
+
+#panko services info
+panko_role_name: admin
+
+## Service Type and Data
+panko_service_region: RegionOne
+panko_service_endpoint_type: internalURL
+panko_service_name: panko
+panko_service_port: 8777
+panko_service_proto: http
+panko_service_type: event
+panko_service_description: "Openstack Panko Service"
+panko_service_project_domain_id: default
+panko_service_user_domain_id: default
+panko_service_user_name: panko
+panko_keystone_auth_plugin: "{{ panko_keystone_auth_type }}"
+panko_keystone_auth_type: password
+panko_service_tenant_name: service
+panko_service_project_name: service
+panko_service_publicuri: "{{ panko_service_proto }}://{{ external_lb_vip_address }}:{{ panko_service_port }}"
+panko_service_publicurl: "{{ panko_service_publicuri }}"
+panko_service_internaluri: "{{ panko_service_proto }}://{{ internal_lb_vip_address }}:{{ panko_service_port }}"
+panko_service_internalurl: "{{ panko_service_internaluri }}"
+panko_service_adminuri: "{{ panko_service_proto }}://{{ internal_lb_vip_address }}:{{ panko_service_port }}"
+panko_service_adminurl: "{{ panko_service_adminuri }}"
+
+panko_service_in_ldap: false
+
+# panko packages that must be installed before anything else
+panko_requires_pip_packages:
+  - virtualenv
+  - virtualenv-tools
+  - python-keystoneclient # Keystoneclient needed to OSA keystone lib
+  - httplib2
+
+# Common pip packages
+panko_pip_packages:
+  # The following constraints are taken from the setup.cfg
+  # file in the panko project. This is due to the fact that the repo-build
+  # role does not respect constraints specified in setup.cfg files.
+  # https://github.com/openstack/panko/blob/master/setup.cfg#L35-L38
+  - alembic>=0.7.2
+  - panko
+  - ceilometermiddleware
+  - cryptography
+  - gnocchiclient
+  - PyMySQL>=0.6.2
+  - python-ceilometerclient
+  - python-memcached
+  - sqlalchemy>=0.9.7
+  - sqlalchemy-utils
+  - warlock
+
+
+
+panko_required_secrets:
+  - memcached_encryption_key
+  - panko_container_db_password
+  - panko_rabbitmq_password
+  - panko_service_password
+
+install_test_packages: False
+
+# This variable is used by the repo_build process to determine
+# which host group to check for members of before building the
+# pip packages required by this role. The value is picked up
+# by the py_pkgs lookup.
+panko_role_project_group: panko_all
+
+## Tunable overrides
+panko_policy_overrides: {}
+panko_panko_conf_overrides: {}
+panko_api_paste_ini_overrides: {}
--- a/examples/playbook.yml
+++ b/examples/playbook.yml
@ -0,0 +1,23 @@
+- name: Install panko services
+  hosts: panko_all
+  user: root
+  roles:
+    - { role: "os_panko" }
+  vars:
+    # Needed for panko to talk to MongoDB
+    panko_container_db_password: "secrete"
+    # Password used for Keystone panko service user
+    panko_service_password: "secrete"
+    # Needed for panko to talk to memcached
+    memcached_servers: 127.0.0.1
+    memcached_encryption_key: "some_key"
+    # Needed to setup the panko service in Keystone
+    keystone_admin_user_name: admin
+    keystone_admin_tenant_name: admin
+    keystone_auth_admin_password: "SuperSecretePassword"
+    keystone_service_adminuri_insecure: false
+    keystone_service_internaluri_insecure: false
+    keystone_service_internaluri: "http://1.2.3.4:5000"
+    keystone_service_internalurl: "{{ keystone_service_internaluri }}/v3"
+    keystone_service_adminuri: "http://5.6.7.8:35357"
+    keystone_service_adminurl: "{{ keystone_service_adminuri }}/v3"
--- a/handlers/main.yml
+++ b/handlers/main.yml
@ -0,0 +1,34 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Copy new policy file into place
+  copy:
+    src: "/etc/panko/policy.json-{{ panko_venv_tag }}"
+    dest: "/etc/panko/policy.json"
+    owner: "root"
+    group: "{{ panko_system_group_name }}"
+    mode: "0640"
+    remote_src: yes
+
+- name: Restart web server
+  service:
+    name: "{{ panko_system_service_name }}"
+    enabled: yes
+    state: "restarted"
+    daemon_reload: "{{ (ansible_service_mgr == 'systemd') | ternary('yes', omit) }}"
+  register: _restart
+  until: _restart | success
+  retries: 5
+  delay: 2
--- a/manual-test.rc
+++ b/manual-test.rc
@ -0,0 +1,33 @@
+export VIRTUAL_ENV=$(pwd)
+export ANSIBLE_HOST_KEY_CHECKING=False
+export ANSIBLE_SSH_CONTROL_PATH=/tmp/%%h-%%r
+
+# TODO (odyssey4me) These are only here as they are non-standard folder
+# names for Ansible 1.9.x. We are using the standard folder names for
+# Ansible v2.x. We can remove this when we move to Ansible 2.x.
+export ANSIBLE_ACTION_PLUGINS=${HOME}/.ansible/plugins/action
+export ANSIBLE_CALLBACK_PLUGINS=${HOME}/.ansible/plugins/callback
+export ANSIBLE_FILTER_PLUGINS=${HOME}/.ansible/plugins/filter
+export ANSIBLE_LOOKUP_PLUGINS=${HOME}/.ansible/plugins/lookup
+
+# This is required as the default is the current path or a path specified
+# in ansible.cfg
+export ANSIBLE_LIBRARY=${HOME}/.ansible/plugins/library
+
+# This is required as the default is '/etc/ansible/roles' or a path
+# specified in ansible.cfg
+export ANSIBLE_ROLES_PATH=${HOME}/.ansible/roles:$(pwd)/..
+
+export ANSIBLE_SSH_ARGS="-o ControlMaster=no \
+  -o UserKnownHostsFile=/dev/null \
+  -o StrictHostKeyChecking=no \
+  -o ServerAliveInterval=64 \
+  -o ServerAliveCountMax=1024 \
+  -o Compression=no \
+  -o TCPKeepAlive=yes \
+  -o VerifyHostKeyDNS=no \
+  -o ForwardX11=no \
+  -o ForwardAgent=yes"
+
+echo "Run manual functional tests by executing the following:"
+echo "# ./.tox/functional/bin/ansible-playbook -i tests/inventory tests/test.yml"
--- a/meta/main.yml
+++ b/meta/main.yml
@ -0,0 +1,39 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+galaxy_info:
+  author: rcbops
+  description: Installation and setup of panko
+  company: Rackspace
+  license: Apache2
+  min_ansible_version: 2.2
+  platforms:
+    - name: Ubuntu
+      versions:
+        - xenial
+  categories:
+    - cloud
+    - python
+    - ceilometer
+    - panko
+    - development
+    - openstack
+dependencies:
+  - pip_install
+  - role: apt_package_pinning
+    when:
+      - ansible_pkg_mgr == 'apt'
+  - galera_client
+  - openstack_openrc
--- a/run_tests.sh
+++ b/run_tests.sh
@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Note:
+# This file is maintained in the openstack-ansible-tests repository.
+# https://git.openstack.org/cgit/openstack/openstack-ansible-tests/tree/run_tests.sh
+# If you need to modify this file, update the one in the openstack-ansible-tests
+# repository and then update this file as well. The purpose of this file is to
+# prepare the host and then execute all the tox tests.
+#
+
+## Shell Opts ----------------------------------------------------------------
+set -xeu
+
+## Vars ----------------------------------------------------------------------
+
+export WORKING_DIR=${WORKING_DIR:-$(pwd)}
+
+## Main ----------------------------------------------------------------------
+
+source /etc/os-release || source /usr/lib/os-release
+
+install_pkg_deps() {
+    pkg_deps="git"
+
+    # Prefer dnf over yum for CentOS.
+    which dnf &>/dev/null && RHT_PKG_MGR='dnf' || RHT_PKG_MGR='yum'
+
+    case ${ID,,} in
+        *suse*) pkg_mgr_cmd="zypper -n in" ;;
+        centos|rhel) pkg_mgr_cmd="${RHT_PKG_MGR} install -y" ;;
+        fedora) pkg_mgr_cmd="dnf -y install" ;;
+        ubuntu|debian) pkg_mgr_cmd="apt-get install -y" ;;
+        *) echo "unsupported distribution: ${ID,,}"; exit 1 ;;
+    esac
+
+    eval sudo $pkg_mgr_cmd $pkg_deps
+}
+
+# Install the host distro package dependencies
+install_pkg_deps
+
+# Clone the tests repo for access to the common test script
+source tests/tests-repo-clone.sh
+
+# Execute the common test script
+source tests/common/run_tests_common.sh
+
--- a/setup.cfg
+++ b/setup.cfg
@ -0,0 +1,24 @@
+[metadata]
+name = openstack-ansible-os_panko
+summary = os_panko for OpenStack Ansible
+description-file =
+    README.rst
+author = OpenStack
+author-email = openstack-dev@lists.openstack.org
+home-page = https://docs.openstack.org/openstack-ansible-os_panko/latest/
+classifier =
+    Intended Audience :: Developers
+    Intended Audience :: System Administrators
+    License :: OSI Approved :: Apache Software License
+    Operating System :: POSIX :: Linux
+
+[build_sphinx]
+all_files = 1
+build-dir = doc/build
+source-dir = doc/source
+
+[pbr]
+warnerrors = True
+
+[wheel]
+universal = 1
--- a/setup.py
+++ b/setup.py
@ -0,0 +1,29 @@
+# Copyright (c) 2013 Hewlett-Packard Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# THIS FILE IS MANAGED BY THE GLOBAL REQUIREMENTS REPO - DO NOT EDIT
+import setuptools
+
+# In python < 2.7.4, a lazy loading of package `pbr` will break
+# setuptools if some other modules registered functions in `atexit`.
+# solution from: http://bugs.python.org/issue15881#msg170215
+try:
+    import multiprocessing  # noqa
+except ImportError:
+    pass
+
+setuptools.setup(
+    setup_requires=['pbr>=2.0.0'],
+    pbr=True)
--- a/tasks/main.yml
+++ b/tasks/main.yml
@ -0,0 +1,59 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Fail if our required secrets are not present
+  fail:
+    msg: "Please set the {{ item }} variable prior to applying this role."
+  when: (item is undefined) or (item is none)
+  with_items: "{{ panko_required_secrets }}"
+  tags:
+    - always
+
+- name: Gather variables for each operating system
+  include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower }}.yml"
+    - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower }}.yml"
+    - "{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower }}.yml"
+    - "{{ ansible_distribution | lower }}.yml"
+    - "{{ ansible_os_family | lower }}.yml"
+  tags:
+    - always
+
+- include: panko_pre_install.yml
+  tags:
+    - panko-install
+
+- include: panko_install.yml
+  tags:
+    - panko-install
+
+- include: panko_post_install.yml
+  tags:
+    - panko-config
+
+- include: panko_db_setup.yml
+  when: inventory_hostname == groups['panko_all'][0]
+  tags:
+    - panko-config
+
+- include: panko_apache.yml
+  tags:
+    - panko-config
+
+- include: panko_service_setup.yml
+  when: inventory_hostname == groups['panko_api'][0]
+  tags:
+    - panko-config
--- a/tasks/panko_apache.yml
+++ b/tasks/panko_apache.yml
@ -0,0 +1,90 @@
+---
+# Copyright 2016, Comcast Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# NOTE(hwoarang) default openSUSE apache2 installation is missing
+# some required modules so enable them here. This can possibly be
+# extended to other distributions if necessary.
+- name: Enable required apache2 modules (SUSE)
+  apache2_module:
+    name: "{{ item.name }}"
+    state: "{{ item.state }}"
+  with_items: "{{ panko_apache_modules }}"
+  when:
+    - ansible_pkg_mgr ==  'zypper'
+    - panko_apache_modules is defined
+  notify:
+    - Restart web server
+
+- name: Drop apache2 virtual host and ports file
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: "root"
+    group: "root"
+  with_items: "{{ panko_apache_config }}"
+  notify:
+    - Restart web server
+
+- name: Disable default apache site
+  file:
+    path: "{{ item }}"
+    state: "absent"
+  with_items: "{{ panko_apache_default_sites }}"
+  notify:
+    - Restart web server
+
+- name: Enabled panko vhost
+  file:
+    src: "{{ panko_apache_site_available }}"
+    dest: "{{ panko_apache_site_enabled }}"
+    state: "link"
+  when:
+    - panko_apache_site_available is defined
+    - panko_apache_site_enabled is defined
+  notify:
+    - Restart web server
+
+- name: Ensure Apache ServerName
+  lineinfile:
+    dest: "{{ panko_apache_conf }}"
+    line: "ServerName {{ inventory_hostname }}"
+  notify:
+    - Restart web server
+
+- name: Ensure Apache ServerTokens
+  lineinfile:
+    dest: "{{ panko_apache_security_conf }}"
+    regexp: '^ServerTokens'
+    line: "ServerTokens {{ panko_apache_servertokens }}"
+  notify:
+    - Restart web server
+
+- name: Ensure Apache ServerSignature
+  lineinfile:
+    dest: "{{ panko_apache_security_conf }}"
+    regexp: '^ServerSignature'
+    line: "ServerSignature {{ panko_apache_serversignature }}"
+  notify:
+    - Restart web server
+
+- name: remove Listen from Apache config
+  lineinfile:
+    dest: "{{ panko_apache_security_conf }}"
+    regexp: '^(Listen.*)'
+    backrefs: yes
+    line: '#\1'
+  notify:
+    - Restart web server
--- a/tasks/panko_db_setup.yml
+++ b/tasks/panko_db_setup.yml
@ -0,0 +1,20 @@
+---
+# Copyright 2016, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Perform a panko DB sync
+  command: "{{ panko_bin }}/panko-dbsync"
+  become: yes
+  become_user: "{{ panko_system_user_name }}"
+  changed_when: false
--- a/tasks/panko_install.yml
+++ b/tasks/panko_install.yml
@ -0,0 +1,135 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Install distro packages
+  package:
+    name: "{{ item }}"
+    state: "{{ panko_package_state }}"
+    update_cache: "{{ (ansible_pkg_mgr in ['apt', 'zypper']) | ternary('yes', omit) }}"
+    cache_valid_time: "{{ (ansible_pkg_mgr == 'apt') | ternary(cache_timeout, omit) }}"
+  register: install_packages
+  until: install_packages|success
+  retries: 5
+  delay: 2
+  with_items: "{{ panko_distro_packages }}"
+
+- name: Install distro packages for testing
+  package:
+    name: "{{ item }}"
+    state: "{{ panko_package_state }}"
+    update_cache: "{{ (ansible_pkg_mgr in ['apt', 'zypper']) | ternary('yes', omit) }}"
+    cache_valid_time: "{{ (ansible_pkg_mgr == 'apt') | ternary(cache_timeout, omit) }}"
+  register: install_packages
+  until: install_packages|success
+  retries: 5
+  delay: 2
+  with_items: "{{ panko_test_distro_packages }}"
+  when: install_test_packages|bool
+
+- name: Create developer mode constraint file
+  copy:
+    dest: "/opt/developer-pip-constraints.txt"
+    content: |
+      {% for item in panko_developer_constraints %}
+      {{ item }}
+      {% endfor %}
+  when: panko_developer_mode | bool
+
+- name: Install requires pip packages
+  pip:
+    name: "{{ panko_requires_pip_packages }}"
+    state: "{{ panko_pip_package_state }}"
+    extra_args: >-
+      {{ panko_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }}
+      {{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }}
+      {{ pip_install_options | default('') }}
+  register: install_packages
+  until: install_packages|success
+  retries: 5
+  delay: 2
+
+- name: Retrieve checksum for venv download
+  uri:
+    url: "{{ panko_venv_download_url | replace('tgz', 'checksum') }}"
+    return_content: yes
+  register: panko_venv_checksum
+  when: panko_venv_download | bool
+
+- name: Attempt venv download
+  get_url:
+    url: "{{ panko_venv_download_url }}"
+    dest: "/var/cache/{{ panko_venv_download_url | basename }}"
+    checksum: "sha1:{{ panko_venv_checksum.content | trim }}"
+  register: panko_get_venv
+  when: panko_venv_download | bool
+
+- name: Remove existing venv
+  file:
+    path: "{{ panko_bin | dirname }}"
+    state: absent
+  when: panko_get_venv | changed
+
+- name: Create panko venv dir
+  file:
+    path: "{{ panko_bin | dirname }}"
+    state: directory
+    mode: "0755"
+  register: panko_venv_dir
+  when: panko_get_venv | changed
+
+- name: Unarchive pre-built venv
+  unarchive:
+    src: "/var/cache/{{ panko_venv_download_url | basename }}"
+    dest: "{{ panko_bin | dirname }}"
+    copy: "no"
+  when: panko_get_venv | changed
+  notify: Restart panko services
+
+- name: Install pip packages
+  pip:
+    name: "{{ panko_pip_packages }}"
+    state: "{{ panko_pip_package_state }}"
+    virtualenv: "{{ panko_bin | dirname }}"
+    virtualenv_site_packages: "no"
+    extra_args: >-
+      {{ panko_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }}
+      {{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }}
+      {{ pip_install_options | default('') }}
+  register: install_packages
+  until: install_packages|success
+  retries: 5
+  delay: 2
+  when: panko_get_venv | failed or panko_get_venv | skipped
+  notify: Restart panko services
+
+- name: CentOS remove python from path first
+  file:
+    path:  "{{ panko_bin | dirname }}/bin/python2.7"
+    state: "absent"
+  when:
+    - ansible_pkg_mgr in ['yum', 'dnf']
+    - panko_get_venv | changed
+
+- name: Update virtualenv path
+  command: >
+    virtualenv-tools --update-path=auto --reinitialize {{ panko_bin | dirname }}
+  when: panko_get_venv | changed
+
+- name: Record the venv tag deployed
+  ini_file:
+    dest: "/etc/ansible/facts.d/openstack_ansible.fact"
+    section: panko
+    option: venv_tag
+    value: "{{ panko_venv_tag }}"
--- a/tasks/panko_post_install.yml
+++ b/tasks/panko_post_install.yml
@ -0,0 +1,49 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Copy panko config
+  config_template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: "{{ panko_system_user_name }}"
+    group: "{{ panko_system_group_name }}"
+    mode: "0644"
+    config_overrides: "{{ item.config_overrides }}"
+    config_type: "{{ item.config_type }}"
+  with_items:
+    - src: "panko.conf.j2"
+      dest: "/etc/panko/panko.conf"
+      config_overrides: "{{ panko_panko_conf_overrides }}"
+      config_type: "ini"
+    - src: "api_paste.ini.j2"
+      dest: "/etc/panko/api_paste.ini"
+      config_overrides: "{{ panko_api_paste_ini_overrides }}"
+      config_type: "ini"
+    - src: "policy.json.j2"
+      dest: "/etc/panko/policy.json-{{ panko_venv_tag }}"
+      config_overrides: "{{ panko_policy_overrides }}"
+      config_type: "json"
+  notify:
+    - Restart web server
+
+- name: Drop panko API WSGI Configs
+  template:
+    src: panko-api-wsgi.py.j2
+    dest: /var/www/cgi-bin/panko/panko-api
+    owner: "{{ panko_system_user_name }}"
+    group: "{{ panko_system_group_name }}"
+    mode: "0755"
+  notify:
+    - Restart web server
--- a/tasks/panko_pre_install.yml
+++ b/tasks/panko_pre_install.yml
@ -0,0 +1,76 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Create the system group
+  group:
+    name: "{{ panko_system_group_name }}"
+    state: "present"
+    system: "yes"
+
+- name: Create the panko system user
+  user:
+    name: "{{ panko_system_user_name }}"
+    group: "{{ panko_system_group_name }}"
+    comment: "{{ panko_system_comment }}"
+    shell: "{{ panko_system_shell }}"
+    system: "yes"
+    createhome: "yes"
+    home: "{{ panko_system_user_home }}"
+
+- name: Create panko dir
+  file:
+    path: "{{ item.path }}"
+    state: directory
+    owner: "{{ item.owner|default(panko_system_user_name) }}"
+    group: "{{ item.group|default(panko_system_group_name) }}"
+    mode: "{{ item.mode|default('0755') }}"
+  with_items:
+    - { path: "/openstack/venvs", mode: "0755", owner: "root", group: "root" }
+    - { path: "/etc/panko" }
+    - { path: "{{ panko_system_user_home }}" }
+    - { path: "{{ panko_system_user_home }}/.ssh", mode: "0700" }
+    - { path: "/var/cache/panko", mode: "0700" }
+
+- name: Create Apache mod_wsgi dirs
+  file:
+    path: "{{ item.path }}"
+    state: directory
+    owner: "{{ item.owner|default(panko_system_user_name) }}"
+    group: "{{ item.group|default(panko_system_group_name) }}"
+    mode: "{{ item.mode|default('0755') }}"
+  with_items:
+    - { path: "/var/www/cgi-bin", owner: root, group: root }
+    - { path: "/var/www/cgi-bin/panko" }
+
+- name: Test for log directory or link
+  shell: |
+    if [ -h "/var/log/panko"  ]; then
+      chown -h {{ panko_system_user_name }}:{{ panko_system_group_name }} "/var/log/panko"
+      chown -R {{ panko_system_user_name }}:{{ panko_system_group_name }} "$(readlink /var/log/panko)"
+    else
+      exit 1
+    fi
+  register: log_dir
+  failed_when: false
+  changed_when: log_dir.rc != 0
+
+- name: Create panko log dir
+  file:
+    path: "/var/log/panko"
+    state: directory
+    owner: "{{ panko_system_user_name }}"
+    group: "{{ panko_system_group_name }}"
+    mode: "0755"
+  when: log_dir.rc != 0
--- a/tasks/panko_service_setup.yml
+++ b/tasks/panko_service_setup.yml
@ -0,0 +1,89 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Ensure panko service
+  keystone:
+    command: "ensure_service"
+    endpoint: "{{ keystone_service_adminurl }}"
+    login_user: "{{ keystone_admin_user_name }}"
+    login_password: "{{ keystone_auth_admin_password }}"
+    login_project_name: "{{ keystone_admin_tenant_name }}"
+    service_name: "{{ panko_service_name }}"
+    service_type: "{{ panko_service_type }}"
+    description: "{{ panko_service_description }}"
+    insecure: "{{ keystone_service_adminuri_insecure }}"
+  register: add_service
+  until: add_service|success
+  retries: 5
+  delay: 2
+
+- name: Ensure panko user
+  keystone:
+    command: "ensure_user"
+    endpoint: "{{ keystone_service_adminurl }}"
+    login_user: "{{ keystone_admin_user_name }}"
+    login_password: "{{ keystone_auth_admin_password }}"
+    login_project_name: "{{ keystone_admin_tenant_name }}"
+    user_name: "{{ panko_service_user_name }}"
+    tenant_name: "{{ panko_service_tenant_name }}"
+    role_name: "{{ panko_role_name }}"
+    password: "{{ panko_service_password }}"
+    insecure: "{{ keystone_service_adminuri_insecure }}"
+  register: add_service
+  when: not panko_service_in_ldap | bool
+  until: add_service|success
+  retries: 5
+  delay: 10
+
+- name: Ensure panko user to admin role
+  keystone:
+    command: "ensure_user_role"
+    endpoint: "{{ keystone_service_adminurl }}"
+    login_user: "{{ keystone_admin_user_name }}"
+    login_password: "{{ keystone_auth_admin_password }}"
+    login_project_name: "{{ keystone_admin_tenant_name }}"
+    user_name: "{{ panko_service_user_name }}"
+    tenant_name: "{{ panko_service_project_name }}"
+    role_name: "{{ panko_role_name }}"
+    insecure: "{{ keystone_service_adminuri_insecure }}"
+  register: add_admin_role
+  when: not panko_service_in_ldap | bool
+  until: add_admin_role|success
+  retries: 5
+  delay: 10
+
+# Create an endpoint
+- name: Ensure panko endpoint
+  keystone:
+    command: "ensure_endpoint"
+    endpoint: "{{ keystone_service_adminurl }}"
+    login_user: "{{ keystone_admin_user_name }}"
+    login_password: "{{ keystone_auth_admin_password }}"
+    login_project_name: "{{ keystone_admin_tenant_name }}"
+    region_name: "{{ panko_service_region }}"
+    service_name: "{{ panko_service_name }}"
+    service_type: "{{ panko_service_type }}"
+    insecure: "{{ keystone_service_adminuri_insecure }}"
+    endpoint_list:
+      - url: "{{ panko_service_publicurl }}"
+        interface: "public"
+      - url: "{{ panko_service_adminurl }}"
+        interface: "admin"
+      - url: "{{ panko_service_internalurl }}"
+        interface: "internal"
+  register: add_service
+  until: add_service|success
+  retries: 5
+  delay: 10
--- a/templates/api_paste.ini.j2
+++ b/templates/api_paste.ini.j2
@ -0,0 +1,41 @@
+[composite:panko+noauth]
+use = egg:Paste#urlmap
+/ = pankoversions_pipeline
+/v2 = pankov2_noauth_pipeline
+
+[composite:panko+keystone]
+use = egg:Paste#urlmap
+/ = pankoversions_pipeline
+/v2 = pankov2_keystone_pipeline
+
+[pipeline:pankoversions_pipeline]
+pipeline = cors http_proxy_to_wsgi pankoversions
+
+[app:pankoversions]
+paste.app_factory = panko.api.app:app_factory
+root = panko.api.controllers.root.VersionsController
+
+[pipeline:pankov2_keystone_pipeline]
+pipeline = cors http_proxy_to_wsgi request_id authtoken pankov2
+
+[pipeline:pankov2_noauth_pipeline]
+pipeline = cors http_proxy_to_wsgi request_id pankov2
+
+[app:pankov2]
+paste.app_factory = panko.api.app:app_factory
+root = panko.api.controllers.v2.root.V2Controller
+
+[filter:authtoken]
+paste.filter_factory = keystonemiddleware.auth_token:filter_factory
+oslo_config_project = panko
+
+[filter:request_id]
+paste.filter_factory = oslo_middleware:RequestId.factory
+
+[filter:cors]
+paste.filter_factory = oslo_middleware.cors:filter_factory
+oslo_config_project = panko
+
+[filter:http_proxy_to_wsgi]
+paste.filter_factory = oslo_middleware.http_proxy_to_wsgi:HTTPProxyToWSGI.factory
+oslo_config_project = panko
--- a/templates/panko-api-wsgi.py.j2
+++ b/templates/panko-api-wsgi.py.j2
@ -0,0 +1,22 @@
+# Copyright 2016 Comcast Corporation
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import os
+
+activate_this = os.path.expanduser("{{ panko_bin }}/activate_this.py")
+execfile(activate_this, dict(__file__=activate_this))
+
+from panko.api import app
+
+application = app.build_wsgi_app()
--- a/templates/panko-httpd.conf.j2
+++ b/templates/panko-httpd.conf.j2
@ -0,0 +1,28 @@
+# {{ ansible_managed }}
+
+<VirtualHost *:{{ panko_service_port }}>
+    WSGIDaemonProcess panko-api lang='en_US.UTF-8' locale='en_US.UTF-8' user={{ panko_system_user_name }} group={{ panko_system_group_name }} processes={{ panko_wsgi_processes }} threads={{ panko_wsgi_threads }} display-name=%{GROUP}
+    WSGIProcessGroup panko-api
+    WSGIScriptAlias / /var/www/cgi-bin/panko/panko-api
+    WSGIApplicationGroup  %{GLOBAL}
+
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%{cu}t %M"
+    </IfVersion>
+
+    LogLevel  {{  panko_apache_log_level }}
+    ErrorLog  /var/log/panko/panko-apache-error.log
+    CustomLog /var/log/panko/panko-access.log combined
+</VirtualHost>
+
+<Directory "/var/www/cgi-bin">
+        AllowOverride None
+        Options +ExecCGI -Includes
+        <IfModule !mod_access_compat.c>
+                Require all granted
+        </IfModule>
+        <IfModule mod_access_compat.c>
+                Order allow,deny
+                Allow from all
+        </IfModule>
+</Directory>
--- a/templates/panko-ports.conf.j2
+++ b/templates/panko-ports.conf.j2
@ -0,0 +1,3 @@
+# {{ ansible_managed }}
+
+Listen {{ panko_service_port }}
--- a/templates/panko.conf.j2
+++ b/templates/panko.conf.j2
@ -0,0 +1,26 @@
+#{{ ansible_managed}}
+
+[DEFAULT]
+# Disable stderr logging
+use_stderr = False
+debug = {{ debug }}
+
+[database]
+connection = {{ panko_connection_string }}
+
+[keystone_authtoken]
+auth_type = {{ panko_keystone_auth_plugin }}
+auth_url = {{ keystone_service_adminurl }}
+project_domain_name = {{ panko_service_project_domain_id }}
+user_domain_name = {{ panko_service_user_domain_id }}
+project_name = {{ panko_service_project_name }}
+username = {{ panko_service_user_name }}
+password = {{ panko_service_password }}
+
+memcached_servers = {{ memcached_servers }}
+
+token_cache_time = 300
+
+# if your memcached server is shared, use these settings to avoid cache poisoning
+memcache_security_strategy = ENCRYPT
+memcache_secret_key = {{ memcached_encryption_key }}
--- a/templates/policy.json.j2
+++ b/templates/policy.json.j2
@ -0,0 +1,7 @@
+{
+    "context_is_admin": "role:admin",
+    "segregation": "rule:context_is_admin",
+
+    "telemetry:events:index": "",
+    "telemetry:events:show": ""
+}
--- a/test-requirements.txt
+++ b/test-requirements.txt
@ -0,0 +1,16 @@
+# The order of packages is significant, because pip processes them in the order
+# of appearance. Changing the order has an impact on the overall integration
+# process, which may cause wedges in the gate later.
+bashate>=0.2 # Apache-2.0
+flake8<2.6.0,>=2.5.4 # MIT
+pyasn1!=0.2.3 # BSD
+pyOpenSSL>=0.14 # Apache-2.0
+requests>=2.14.2 # Apache-2.0
+ndg-httpsclient>=0.4.2;python_version<'3.0' # BSD
+
+# this is required for the docs build jobs
+sphinx>=1.6.2 # BSD
+openstackdocstheme>=1.16.0 # Apache-2.0
+doc8 # Apache-2.0
+reno!=2.3.1,>=1.8.0 # Apache-2.0
+sphinxmark>=0.1.14 # Apache-2.0
--- a/tests/ansible-role-requirements.yml
+++ b/tests/ansible-role-requirements.yml
@ -0,0 +1,45 @@
+- name: apt_package_pinning
+  src: https://git.openstack.org/openstack/openstack-ansible-apt_package_pinning
+  scm: git
+  version: stable/pike
+- name: pip_install
+  src: https://git.openstack.org/openstack/openstack-ansible-pip_install
+  scm: git
+  version: stable/pike
+- name: memcached_server
+  src: https://git.openstack.org/openstack/openstack-ansible-memcached_server
+  scm: git
+  version: stable/pike
+- name: openstack_hosts
+  src: https://git.openstack.org/openstack/openstack-ansible-openstack_hosts
+  scm: git
+  version: stable/pike
+- name: lxc_hosts
+  src: https://git.openstack.org/openstack/openstack-ansible-lxc_hosts
+  scm: git
+  version: stable/pike
+- name: lxc_container_create
+  src: https://git.openstack.org/openstack/openstack-ansible-lxc_container_create
+  scm: git
+  version: stable/pike
+- name: galera_client
+  src: https://git.openstack.org/openstack/openstack-ansible-galera_client
+  scm: git
+  version: stable/pike
+- name: galera_server
+  src: https://git.openstack.org/openstack/openstack-ansible-galera_server
+  scm: git
+  version: stable/pike
+- name: rabbitmq_server
+  src: https://git.openstack.org/openstack/openstack-ansible-rabbitmq_server
+  scm: git
+  version: stable/pike
+- name: os_keystone
+  src: https://git.openstack.org/openstack/openstack-ansible-os_keystone
+  scm: git
+  version: stable/pike
+- name: openstack_openrc
+  src: https://git.openstack.org/openstack/openstack-ansible-openstack_openrc
+  scm: git
+  version: stable/pike
+
--- a/tests/group_vars/all_containers.yml
+++ b/tests/group_vars/all_containers.yml
@ -0,0 +1,27 @@
+---
+# Copyright 2016, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ansible_host: "{{ ansible_host }}"
+container_name: "{{ inventory_hostname }}"
+container_networks:
+  management_address:
+    address: "{{ ansible_host }}"
+    bridge: "br-mgmt"
+    interface: "eth1"
+    netmask: "255.255.255.0"
+    type: "veth"
+physical_host: localhost
+properties:
+  service_name: "{{ inventory_hostname }}"
--- a/tests/host_vars/infra1.yml
+++ b/tests/host_vars/infra1.yml
@ -0,0 +1,18 @@
+---
+# Copyright 2016, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ansible_host: 10.1.0.2
+ansible_become: True
+ansible_user: root
--- a/tests/host_vars/localhost.yml
+++ b/tests/host_vars/localhost.yml
@ -0,0 +1,19 @@
+---
+# Copyright 2016, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+bridges:
+  - "br-mgmt"
+
+ansible_python_interpreter: "/usr/bin/python2"
--- a/tests/host_vars/openstack1.yml
+++ b/tests/host_vars/openstack1.yml
@ -0,0 +1,18 @@
+---
+# Copyright 2016, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ansible_host: 10.1.0.3
+ansible_become: True
+ansible_user: root
--- a/tests/inventory
+++ b/tests/inventory
@ -0,0 +1,35 @@
+[all]
+localhost
+infra1
+openstack1
+
+[all_containers]
+infra1
+openstack1
+
+[rabbitmq_all]
+infra1
+
+[galera_all]
+infra1
+
+[memcached_all]
+infra1
+
+[service_all:children]
+rabbitmq_all
+galera_all
+memcached_all
+
+[keystone_all]
+infra1
+
+[utility_all]
+infra1
+
+[panko_all]
+openstack1
+
+[panko_api]
+openstack1
+
--- a/tests/os_panko-overrides.yml
+++ b/tests/os_panko-overrides.yml
@ -0,0 +1,25 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+panko_container_db_password: "secrete"
+panko_db_address: "{{ test_galera_host }}"
+panko_database_name: panko
+panko_venv_tag: "testing"
+panko_developer_mode: true
+panko_service_password: "secrete"
+panko_service_publicuri: "{{ panko_service_proto }}://{{ hostvars[groups['panko_all'][0]]['ansible_host'] }}:{{ panko_service_port }}"
+panko_service_internaluri: "{{ panko_service_proto }}://{{ hostvars[groups['panko_all'][0]]['ansible_host'] }}:{{ panko_service_port }}"
+panko_service_adminuri: "{{ panko_service_proto }}://{{ hostvars[groups['panko_all'][0]]['ansible_host'] }}:{{ panko_service_port }}"
+
--- a/tests/test-install-panko.yml
+++ b/tests/test-install-panko.yml
@ -0,0 +1,27 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Playbook for deploying panko
+  hosts: panko_all
+  user: root
+  gather_facts: true
+  pre_tasks:
+    - include: common/create-grant-db.yml
+      db_name: "{{ panko_database_name }}"
+      db_password: "{{ panko_container_db_password }}"
+  roles:
+    - role: "{{ panko_rolename | default('os_panko') }}"
+  vars_files:
+    - common/test-vars.yml
--- a/tests/test.yml
+++ b/tests/test.yml
@ -0,0 +1,27 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Setup the host
+- include: common/test-setup-host.yml
+
+# Install RabbitMQ/MariaDB
+- include: common/test-install-infra.yml
+
+# Install Keystone
+- include: common/test-install-keystone.yml
+
+# Install panko
+- include: test-install-panko.yml
+
--- a/tests/tests-repo-clone.sh
+++ b/tests/tests-repo-clone.sh
@ -0,0 +1,117 @@
+#!/bin/bash
+# Copyright 2017, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# PURPOSE:
+# This script clones the openstack-ansible-tests repository to the
+# tests/common folder in order to be able to re-use test components
+# for role testing.
+
+# WARNING:
+# This file is maintained in the openstack-ansible-tests repository:
+# https://git.openstack.org/cgit/openstack/openstack-ansible-tests
+# If you need to change this script, then propose the change there.
+# Once it merges, the change will be replicated to the other repositories.
+
+## Shell Opts ----------------------------------------------------------------
+
+set -e
+
+## Vars ----------------------------------------------------------------------
+
+export TESTING_HOME=${TESTING_HOME:-$HOME}
+export WORKING_DIR=${WORKING_DIR:-$(pwd)}
+export CLONE_UPGRADE_TESTS=${CLONE_UPGRADE_TESTS:-no}
+export ZUUL_TESTS_CLONE_LOCATION="/home/zuul/src/git.openstack.org/openstack/openstack-ansible-tests"
+
+## Functions -----------------------------------------------------------------
+
+function create_tests_clonemap {
+
+# Prepare the clonemap for zuul-cloner to use
+cat > ${TESTING_HOME}/tests-clonemap.yaml << EOF
+clonemap:
+  - name: openstack/openstack-ansible-tests
+    dest: ${WORKING_DIR}/tests/common
+EOF
+
+}
+
+## Main ----------------------------------------------------------------------
+
+# If zuul-cloner is present, use it so that we
+# also include any dependent patches from the
+# tests repo noted in the commit message.
+# We only want to use zuul-cloner if we detect
+# zuul v2 running, so we check for the presence
+# of the ZUUL_REF environment variable.
+# ref: http://git.openstack.org/cgit/openstack-infra/zuul/tree/zuul/ansible/filter/zuul_filters.py?h=feature/zuulv3#n17
+if [[ -x /usr/zuul-env/bin/zuul-cloner ]] && [[ "${ZUUL_REF:-none}" != "none" ]]; then
+
+    # Prepare the clonemap for zuul-cloner to use
+    create_tests_clonemap
+
+    # Execute the clone
+    /usr/zuul-env/bin/zuul-cloner \
+        --cache-dir /opt/git \
+        --map ${TESTING_HOME}/tests-clonemap.yaml \
+        git://git.openstack.org \
+        openstack/openstack-ansible-tests
+
+    # Clean up the clonemap.
+    rm -f ${TESTING_HOME}/tests-clonemap.yaml
+
+# Alternatively, use a simple git-clone. We do
+# not re-clone if the directory exists already
+# to prevent overwriting any local changes which
+# may have been made.
+elif [[ ! -d tests/common ]]; then
+
+    # The tests repo doesn't need a clone, we can just
+    # symlink it. As zuul v3 clones into a folder called
+    # 'workspace' we have to use one of its environment
+    # variables to determine the project name.
+    if [[ "${ZUUL_SHORT_PROJECT_NAME:-none}" == "openstack-ansible-tests" ]] ||\
+       [[ "$(basename ${WORKING_DIR})" == "openstack-ansible-tests" ]]; then
+        ln -s ${WORKING_DIR} ${WORKING_DIR}/tests/common
+
+    # In zuul v3 any dependent repository is placed into
+    # /home/zuul/src/git.openstack.org, so we check to see
+    # if there is a tests checkout there already. If so, we
+    # symlink that and use it.
+    elif [[ -d "${ZUUL_TESTS_CLONE_LOCATION}" ]]; then
+        ln -s "${ZUUL_TESTS_CLONE_LOCATION}" ${WORKING_DIR}/tests/common
+
+    # Otherwise we're clearly not in zuul or using a previously setup
+    # repo in some way, so just clone it from upstream.
+    else
+        git clone -b stable/pike \
+            https://git.openstack.org/openstack/openstack-ansible-tests \
+            ${WORKING_DIR}/tests/common
+    fi
+fi
+
+# If this test set includes an upgrade test, the
+# previous stable release tests repo must also be
+# cloned.
+# Note:
+# Dependent patches to the previous stable release
+# tests repo are not supported.
+if [[ "${CLONE_UPGRADE_TESTS}" == "yes" ]]; then
+    if [[ ! -d "${WORKING_DIR}/tests/common/previous" ]]; then
+        git clone -b stable/ocata \
+            https://git.openstack.org/openstack/openstack-ansible-tests \
+            ${WORKING_DIR}/tests/common/previous
+  fi
+fi
--- a/tox.ini
+++ b/tox.ini
@ -0,0 +1,114 @@
+[tox]
+minversion = 2.0
+skipsdist = True
+envlist = docs,linters,functional
+
+
+[testenv]
+usedevelop = True
+install_command =
+    pip install -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt?h=stable/pike} {opts} {packages}
+deps =
+    -r{toxinidir}/test-requirements.txt
+commands =
+    /usr/bin/find . -type f -name "*.pyc" -delete
+passenv =
+    HOME
+    http_proxy
+    HTTP_PROXY
+    https_proxy
+    HTTPS_PROXY
+    no_proxy
+    NO_PROXY
+whitelist_externals =
+    bash
+setenv =
+    PYTHONUNBUFFERED=1
+    ROLE_NAME=os_panko
+    TEST_IDEMPOTENCE=false
+    VIRTUAL_ENV={envdir}
+    WORKING_DIR={toxinidir}
+
+
+[testenv:docs]
+commands=
+    bash -c "rm -rf doc/build"
+    doc8 doc
+    python setup.py build_sphinx
+
+
+[doc8]
+# Settings for doc8:
+extensions = .rst
+
+
+[testenv:releasenotes]
+commands =
+    sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
+
+
+# environment used by the -infra templated docs job
+[testenv:venv]
+commands =
+    {posargs}
+
+
+[testenv:pep8]
+commands =
+    bash -c "{toxinidir}/tests/tests-repo-clone.sh"
+    bash -c "{toxinidir}/tests/common/test-pep8.sh"
+
+
+[flake8]
+# Ignores the following rules due to how ansible modules work in general
+#     F403 'from ansible.module_utils.basic import *' used;
+#          unable to detect undefined names
+ignore=F403
+
+
+[testenv:bashate]
+commands =
+    bash -c "{toxinidir}/tests/tests-repo-clone.sh"
+    bash -c "{toxinidir}/tests/common/test-bashate.sh"
+
+
+[testenv:ansible]
+deps =
+    {[testenv]deps}
+    -rhttps://git.openstack.org/cgit/openstack/openstack-ansible/plain/global-requirement-pins.txt?h=stable/pike
+    -rhttps://git.openstack.org/cgit/openstack/openstack-ansible-tests/plain/test-ansible-deps.txt?h=stable/pike
+
+
+[testenv:ansible-syntax]
+deps =
+    {[testenv:ansible]deps}
+commands =
+    bash -c "{toxinidir}/tests/tests-repo-clone.sh"
+    bash -c "{toxinidir}/tests/common/test-ansible-syntax.sh"
+
+
+[testenv:ansible-lint]
+deps =
+    {[testenv:ansible]deps}
+commands =
+    bash -c "{toxinidir}/tests/tests-repo-clone.sh"
+    bash -c "{toxinidir}/tests/common/test-ansible-lint.sh"
+
+
+[testenv:functional]
+deps =
+    {[testenv:ansible]deps}
+commands =
+    bash -c "{toxinidir}/tests/tests-repo-clone.sh"
+    bash -c "{toxinidir}/tests/common/test-ansible-functional.sh"
+
+
+[testenv:linters]
+deps =
+    {[testenv:ansible]deps}
+commands =
+    {[testenv:pep8]commands}
+    {[testenv:bashate]commands}
+    {[testenv:ansible-lint]commands}
+    {[testenv:ansible-syntax]commands}
+    {[testenv:docs]commands}
--- a/vars/debian.yml
+++ b/vars/debian.yml
@ -0,0 +1,47 @@
+---
+# Copyright 2016, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+## APT Cache options
+cache_timeout: 600
+
+# Common apt packages
+panko_distro_packages:
+  - rpcbind
+  - apache2
+  - apache2-utils
+  - libapache2-mod-wsgi
+  - libffi-dev
+  - libssl-dev
+  - libxml2-dev
+  - libxslt1-dev
+
+panko_test_distro_packages:
+  - git
+
+panko_system_service_name: apache2
+
+panko_apache_config:
+  - { src: "panko-ports.conf.j2", dest: "/etc/apache2/ports.conf" }
+  - { src: "panko-httpd.conf.j2", dest: "/etc/apache2/sites-available/panko-httpd.conf" }
+
+panko_apache_default_sites:
+  - "/etc/apache2/sites-enabled/000-default.conf"
+
+panko_apache_site_available: "/etc/apache2/sites-available/panko-httpd.conf"
+panko_apache_site_enabled: "/etc/apache2/sites-enabled/panko-httpd.conf"
+
+panko_apache_conf: "/etc/apache2/apache2.conf"
+panko_apache_security_conf: "/etc/apache2/conf-available/security.conf"
+
--- a/vars/redhat-7.yml
+++ b/vars/redhat-7.yml
@ -0,0 +1,44 @@
+---
+# Copyright 2016, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Common packages
+panko_distro_packages:
+  - rpcbind
+  - httpd
+  - httpd-tools
+  - mod_wsgi
+  - libffi-devel
+  - openssl-devel
+  - libxml2-devel
+  - libxslt-devel
+  - which
+
+panko_test_distro_packages:
+  - git
+
+panko_system_service_name: httpd
+
+panko_apache_config:
+  - { src: "panko-ports.conf.j2", dest: "/etc/httpd/conf.d/ports.conf" }
+  - { src: "panko-httpd.conf.j2", dest: "/etc/httpd/conf.d/panko-httpd.conf" }
+
+panko_apache_default_sites:
+  - "/etc/httpd/conf.d/userdir.conf"
+  - "/etc/httpd/conf.d/welcome.conf"
+  - "/etc/httpd/conf.d/ssl.conf"
+
+panko_apache_conf: "/etc/httpd/conf/httpd.conf"
+panko_apache_security_conf: "{{ panko_apache_conf }}"
+
--- a/vars/suse-42.yml
+++ b/vars/suse-42.yml
@ -0,0 +1,50 @@
+---
+# Copyright 2016, Rackspace US, Inc.
+# Copyright 2017, SUSE LINUX GmbH.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Common packages
+panko_distro_packages:
+  - rpcbind
+  - apache2
+  - apache2-utils
+  - apache2-mod_wsgi
+  - libffi-devel
+  - libopenssl-devel
+  - libxml2-devel
+  - libxslt-devel
+  - which
+
+panko_test_distro_packages:
+  - git-core
+
+panko_system_service_name: apache2
+
+panko_apache_config:
+  - { src: "panko-ports.conf.j2", dest: "/etc/apache2/conf.d/ports.conf" }
+  - { src: "panko-httpd.conf.j2", dest: "/etc/apache2/conf.d/panko-httpd.conf" }
+
+panko_apache_default_sites:
+  - "/etc/apache2/conf.d/gitweb.conf"
+
+panko_apache_conf: "/etc/apache2/httpd.conf"
+panko_apache_security_conf: "{{ panko_apache_conf }}"
+
+panko_apache_modules:
+  - name: "authz_host"
+    state: "present"
+  - name: "access_compat"
+    state: "present"
+  - name: "version"
+    state: "present"
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@ -0,0 +1,28 @@
+---
+# Copyright 2017, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- project:
+    name: openstack/openstack-ansible-os_panko
+    check:
+      jobs:
+        - openstack-ansible-linters
+        - openstack-ansible-functional-centos-7
+        - openstack-ansible-functional-opensuse-423-nv
+        - openstack-ansible-functional-ubuntu-xenial
+    gate:
+      jobs:
+        - openstack-ansible-linters
+        - openstack-ansible-functional-centos-7
+        - openstack-ansible-functional-ubuntu-xenial