[TRAIN ONLY] Introduce hybrid state for nova compute

Queens runs on CentOS7/RHEL8. Train runs on CentOS7 upstream,
but only RHEL8 downstream.

It is vastly impractical for a large compute environment to
upgrade the entire environment in one go. Typically there is
a need to do so in batches. Part of the process requires
ensuring that the compute service from Train is running on
the RHEL7 hypervisor so that we can live-migrate instances
between the RHEL7 hypervisor and a RHEL8 hypervisor.

This allows us to evacuate a hypervisor on RHEL7, upgrade or
replace it, then migrate instances on to it and continue
rolling to the next compute host.

This patch introduces this 'hybrid' state to make this
possible.

Change-Id: Ice37f2773d35e428a57006586397cc4cfaa99164

deployment/nova/nova-compute-container-puppet.yaml

@@ -392,6 +392,12 @@ parameters:
     default: ""
     tags:
       - role_specific
+  DockerInsecureRegistryAddress:
+    description: Optional. The IP Address and Port of an insecure docker
+                 namespace that will be configured in /etc/sysconfig/docker.
+                 The value can be multiple addresses separated by commas.
+    type: comma_delimited_list
+    default: []
 
   # DEPRECATED: the following options are deprecated and are currently maintained
   # for backwards compatibility. They will be removed in future release.
@@ -565,6 +571,7 @@ resources:
               NovaPMEMNamespaces: {get_param: NovaPMEMNamespaces}
 
 conditions:
+  insecure_registry_is_empty: {equals : [{get_param: DockerInsecureRegistryAddress}, []]}
   enable_instance_ha: {equals: [{get_param: EnableInstanceHA}, true]}
 
   enable_live_migration_tunnelled:
@@ -1078,6 +1085,58 @@ outputs:
             - tripleo_nvdimm_pmem_namespaces != ''
       external_post_deploy_tasks: {get_attr: [NovaComputeCommon, nova_compute_common_deploy_steps_tasks]}
       upgrade_tasks:
+        - name: Switch compute to hybrid state
+          vars:
+            nova_compute_image: {get_param: ContainerNovaComputeImage}
+          tags:
+            - never
+            - nova_hybrid_state
+          when: step|int == 0
+          block:
+            - name: Check if we need to update the paunch config
+              shell: |
+                set -o pipefail
+                jq ."nova_compute"."image" /var/lib/tripleo-config/docker-container-startup-config-step_4.json
+              register: nova_compute_paunch_image
+            - name: Implement the hybrid state (only if the compute is still Queens)
+              when: nova_compute_paunch_image.stdout != nova_compute_image
+              block:
+                - name: Update the nova_compute paunch image in config
+                  shell: |
+                    set -o pipefail
+                    cat <<< $(jq '.nova_compute.image = "{{ nova_compute_image }}"' \
+                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json) >\
+                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json
+                # Nova compute will not work unless we ensure it will not connect against db and use messaging
+                - name: Remove database section from nova_compute config
+                  shell: crudini --del database /var/lib/config-data/puppet-generated/nova_libvirt/etc/nova/nova.conf
+                - name: Remove api_database section from nova_compute config
+                  shell: crudini --del api_database /var/lib/config-data/puppet-generated/nova_libvirt/etc/nova/nova.conf
+                # This code is partial copy of logic in podman installation
+                - name: Make sure the Undercloud hostname is included in /etc/hosts
+                  when:
+                    - undercloud_hosts_entries is defined
+                  lineinfile:
+                    dest: /etc/hosts
+                    line: "{{ undercloud_hosts_entries | join('') }}"
+                    state: present
+                - name: Set container_registry_insecure_registries fact.
+                  set_fact:
+                    container_registry_insecure_registries:
+                      if:
+                        - insecure_registry_is_empty
+                        - []
+                        - {get_param: DockerInsecureRegistryAddress}
+                - name: Set container_registry_insecure registries
+                  when: container_registry_insecure_registries != []
+                  shell: crudini --set /etc/containers/registries.conf registries.insecure registries "[{{ container_registry_insecure_registries | map('regex_replace', '(.*)', "'\1'") | join(',') }}]"
+                - name: Restart docker
+                  service:
+                    name: docker
+                    state: restarted
+                # Finally apply the paunch config to start the new nova_compute
+                - name: Apply paunch config
+                  shell: paunch apply --file /var/lib/tripleo-config/docker-container-startup-config-step_4.json --config-id tripleo_step4
         - name: Remove openstack-nova-compute and python-nova package during upgrade
           package:
             name: