Globally disable service resource in containers

... because the resource is valid only at host level. This helps us
avoid triggering service resources unexpectedly when we add specific
puppet classes (eg. rsync::server) to puppet_tags.

This also fixes the package resource which is not properly noop'ed in
conainer puppet tasks.

Change-Id: I2ce12fadd2bd1c65c098108362bb337ecd38d1a7

common/container-puppet.sh

@@ -24,7 +24,11 @@ if [ -n "$PUPPET_TAGS" ]; then
 fi
 
 if [ ! -z ${STEP_CONFIG+x} ]; then
-    echo -e "${STEP_CONFIG}" | tee /etc/config.pp
+    # package and service should NOT be managed inside containers
+    echo -e "noop_resource('package')" | tee /etc/config.pp
+    echo -e "noop_resource('service')" | tee -a /etc/config.pp
+
+    echo -e "${STEP_CONFIG}" | tee -a /etc/config.pp
 fi
 
 CHECK_MODE=""

deployment/containers-common.yaml

@@ -80,7 +80,7 @@ outputs:
               --color=false \
               --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \
               --tags $TAGS \
-              -e "noop_resource('package'); ${CONFIG}"
+              -e "noop_resource('package'); noop_resource('service') ;${CONFIG}"
           rc=$?
           set -e
           set +ux

deployment/swift/swift-storage-container-puppet.yaml

@@ -274,7 +274,6 @@ outputs:
             - "\n"
             - - "class xinetd() {}"
               - "define xinetd::service($bind='',$port='',$server='',$server_args='') {}"
-              - "noop_resource('service')"
               - "include tripleo::profile::base::swift::storage"
         config_image: {get_attr: [RoleParametersValue, value, ContainerSwiftConfigImage]}
       kolla_config: