Fix Octavia amphora image RPM install

The Octavia amphora image RPM failed to install on the undercloud on Red
Hat platforms. Reason was the Ansible playbook, specifically the
octavia-undercloud role, runs as part of octavia_post_deploy workbook as
'mistral' user which is a non-privileged user. Because of this, the
overcloud deployment exits with error when Octavia service is enabled
and tries to install the RPm or updating to latest its version.

This fix is not ideal. Other ways of fixing it have been attempted and
didn't work. For example, moving the image installation and further
image handling logic to an overcloud controller node where we would have
user privileged access to install the RPM. It proved to be less optimal
than current approach because a) controller node would need to be
subscribed to Red Hat OpenStack Platform RPM channels which in many
cases does not happen and b) would require reaching Internet to download
RPM.

This patch instead switches to using Ansible raw module [1] and
whitelist a yum command in sudoers for mistral user. Neither yum, shell
or command modules can be used as they run as Ansible sends Python code
to be executed on the targeted servers. Should we've gone that path,
we'd have needed to whitelist a hugly and insecure regex as follows:

mistral ALL = NOPASSWD: /usr/bin/python /tmp/ansible-*/yum.py*

So, instead the raw module had to be used as it bypasses Ansible's
module subsystem. Ansible runs the command directly in the target host
and we can predictably allow execution of that particular command with
privileged access.

[1] http://docs.ansible.com/ansible/latest/modules/raw_module.html

Closes-Bug: #1772880
Change-Id: I84b0d4f18f1c382201dd5cf782152c5e973da513

playbooks/roles/octavia-undercloud/tasks/main.yml

@@ -11,9 +11,7 @@
 
   - block:
       - name: install Octavia amphora image if Red Hat
-        yum:
-          name: octavia-amphora-image
-          state: latest
+        raw: sudo yum -y install octavia-amphora-image
       - name: set location if Red Hat
         set_fact:
           image_filename: "/usr/share/rhosp-director-images/octavia-amphora.qcow2"

releasenotes/notes/fix-octavia-image-rpm-install-permissions-846cd6780a527084.yaml

@@ -0,0 +1,5 @@
+---
+fixes:
+  - Fix Octavia amphora image RPM install on undercloud node for Red Hat based
+    deployments (`bug 1772880
+    <https://bugs.launchpad.net/tripleo/+bug/1772880>`)

sudoers

@@ -9,4 +9,5 @@ mistral ALL = NOPASSWD: /usr/bin/rm -f /tmp/validations_identity_[A-Za-z0-9_][A-
 mistral ALL = NOPASSWD: /bin/nova-manage cell_v2 discover_hosts *
 mistral ALL = NOPASSWD: /usr/bin/tar --ignore-failed-read -C / -cf /var/tmp/undercloud-backup-*.tar *
 mistral ALL = NOPASSWD: /usr/bin/chown mistral. /var/tmp/undercloud-backup-*/filesystem-*.tar
+mistral ALL = NOPASSWD: /usr/bin/yum -y install octavia-amphora-image
 validations ALL = NOPASSWD: ALL