Ensure that upper constraints are always applied

When the upper constraints are not applied, the resulting
build for the same tag may be different from one day to
the next. This results in an inconsistent experience for
deployers.

This patch sets the upper constraints to be used by the
following:
- https://review.openstack.org/388159 (lxc hosts)
- https://review.openstack.org/388072 (pip install)
- https://review.openstack.org/388230 (keystone install)
  This is a pattern to establish across other roles.

As some pip installs happen before the repo server is up
a common set of tasks is added to a few of the plays to
verify if there is a local copy of constraints available.
If not it will then source the upstream constraints based
on the OpenStack requirements SHA that's been pinned.

Change-Id: I7ddd44be30c610609c1429147646dcb1d3e6ca59

playbooks/common-tasks/set-upper-constraints.yml

@@ -0,0 +1,32 @@
+---
+# Copyright 2016, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This set of tasks checks whether the repo is up yet. If it is it
+# will use the compiled upper constraints available there. If it
+# is not yet up, then it will use the upstream upper constraints
+# for the SHA currently pinned.
+
+- name: Test internal repo URL for the current upper constraints file
+  uri:
+    url: "{{ pip_install_upper_constraints }}"
+    method: "HEAD"
+  register: upper_constraints_check
+  failed_when: false
+
+- name: Set pip install upper constraints
+  set_fact:
+    pip_install_upper_constraints: >-
+      http://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt?id={{ requirements_git_install_branch | regex_replace(' #.*$','') }}
+  when: upper_constraints_check.status != 200

playbooks/inventory/group_vars/all.yml

@@ -46,6 +46,9 @@ pip_links:
   - { name: "openstack_release", link: "{{ openstack_repo_url }}/os-releases/{{ openstack_release }}/" }
 pip_lock_to_internal_repo: "{{ (pip_links | length) >= 1 }}"
 
+# The upper constraints to apply to all pip installations
+pip_install_upper_constraints: "{{ openstack_repo_url }}/os-releases/{{ openstack_release }}/requirements_constraints.txt"
+
 ## OpenStack source options
 # URL for the frozen internal openstack repo.
 repo_server_port: 8181

playbooks/lxc-hosts-setup.yml

@@ -19,6 +19,7 @@
   max_fail_percentage: 20
   user: root
   pre_tasks:
+    - include: common-tasks/set-upper-constraints.yml
     - name: Check the state of the default LXC service log directory
       stat:
         path: "/var/log/lxc"
@@ -49,6 +50,8 @@
       rsyslog_client_config_name: "99-lxc-rsyslog-client.conf"
       tags:
         - rsyslog
+  vars_files:
+    - defaults/repo_packages/openstack_services.yml
   vars:
     pip_lock_to_internal_repo: False
   tags:

playbooks/repo-build.yml

@@ -31,6 +31,9 @@
   user: root
   serial: 1
   pre_tasks:
+
+    - include: common-tasks/set-upper-constraints.yml
+
     - name: Load local packages
       debug:
         msg: "Loading Packages"
@@ -108,6 +111,8 @@
       when:
         - "groups['repo_servers_{{ ansible_architecture }}'] | length > 0"
         - "inventory_hostname == groups['repo_servers_{{ ansible_architecture }}'][0]"
+  vars_files:
+    - defaults/repo_packages/openstack_services.yml
   vars:
     pkg_locations:
       - ../

playbooks/repo-server.yml

@@ -20,6 +20,8 @@
   user: root
   pre_tasks:
 
+    - include: common-tasks/set-upper-constraints.yml
+
     - name: Check if the git cache exists on deployment host
       local_action:
         module: stat
@@ -62,6 +64,8 @@
       rsyslog_client_config_name: "99-lsyncd-rsyslog-client.conf"
       tags:
         - rsyslog
+  vars_files:
+    - defaults/repo_packages/openstack_services.yml
   vars:
     is_metal: "{{ properties.is_metal|default(false) }}"
   tags:

playbooks/unbound-install.yml

@@ -18,6 +18,8 @@
     - unbound_all
   gather_facts: "{{ gather_facts | default(True) }}"
   user: root
+  pre_tasks:
+    - include: common-tasks/set-upper-constraints.yml
   roles:
     - role: "unbound"
       tags:
@@ -25,6 +27,8 @@
     - role: "system_crontab_coordination"
       tags:
         - "system-crontab-coordination"
+  vars_files:
+    - defaults/repo_packages/openstack_services.yml
   vars:
     is_metal: "{{ properties.is_metal|default(false) }}"