Run resolvconf role on hosts only after unbound is deployed

Change I829747094cabc8027bad904cb822a6d265f48d73 creates a race
condition where the resolvconf role is executed against the host
before the unbound containers are deployed, breaking the host's DNS
resolution capabilities.

We should only execute resolvconf against the hosts after the
unbound role has deployed the resolver containers.

Change-Id: Ica221a075cefce9ce485b9d9dc8a540d40627413

playbooks/lxc-hosts-setup.yml

@@ -13,12 +13,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- include: common-playbooks/unbound-clients.yml
-  vars:
-    unbound_group: "{{ lxc_host_group | default('lxc_hosts')}}"
-  when:
-    - resolvconf_enabled | bool
-
 - name: Basic lxc host setup
   hosts: "{{ lxc_host_group | default('lxc_hosts')}}"
   gather_facts: "{{ gather_facts | default(True) }}"

playbooks/openstack-hosts-setup.yml

@@ -13,12 +13,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- include: common-playbooks/unbound-clients.yml
-  vars:
-    unbound_group: "{{ openstack_host_group|default('hosts') }}"
-  when:
-    - resolvconf_enabled | bool
-
 - name: Install Ansible prerequisites
   hosts: "{{ openstack_host_group|default('hosts') }}"
   gather_facts: false

playbooks/unbound-install.yml

@@ -33,3 +33,9 @@
     - defaults/repo_packages/openstack_services.yml
   vars:
     is_metal: "{{ properties.is_metal|default(false) }}"
+
+- include: common-playbooks/unbound-clients.yml
+  vars:
+    unbound_group: "{{ openstack_host_group|default('hosts') }}:{{ lxc_host_group | default('lxc_hosts') }}"
+  when:
+    - resolvconf_enabled | bool