CI: Rework deploy.sh to an Ansible role

Change-Id: Iecb212c38732d38f704f1a7d43036f8bbade496a
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>

8 files changed, 110 insertions, 91 deletions

diff --git a/roles/kolla-ansible-deploy/tasks/certificates.yml b/roles/kolla-ansible-deploy/tasks/certificates.yml
new file mode 100644
index 000000000..6296a1dbe
--- /dev/null
+++ b/roles/kolla-ansible-deploy/tasks/certificates.yml
@@ -0,0 +1,39 @@
+---
+- name: Generate self-signed certificates for the optional internal TLS tests
+  ansible.builtin.shell:
+    cmd: >
+     . {{ kolla_ansible_venv_path }}/bin/activate &&
+     kolla-ansible certificates
+     -i /etc/kolla/inventory
+     -vvv
+     >/tmp/logs/ansible/certificates 2>&1
+
+- name: Init pebble when Lets Encrypt is enabled
+  when: (le_enabled | default(False)) | bool
+  block:
+    - name: "Run pebble container"
+      become: true
+      community.docker.docker_container:
+        name: pebble
+        image: "ghcr.io/letsencrypt/pebble:latest"
+        env:
+          PEBBLE_VA_NOSLEEP: "1"
+          PEBBLE_VA_ALWAYS_VALID: "1"
+        network_mode: host
+
+    - name: "Wait for pebble to start"
+      ansible.builtin.wait_for:
+        port: 15000
+        delay: 3
+
+    - name: "Copy pebble miniCA to /etc/kolla/certificates"
+      become: true
+      ansible.builtin.command:
+        cmd: "docker cp pebble:/test/certs/pebble.minica.pem /etc/kolla/certificates/ca/pebble-root.crt"
+
+    - name: "Fetch pebble.crt and store it in /etc/kolla/certificates/ca/"
+      become: true
+      ansible.builtin.get_url:
+        url: "https://127.0.0.1:15000/roots/0"
+        dest: "/etc/kolla/certificates/ca/pebble.crt"
+        validate_certs: false
diff --git a/roles/kolla-ansible-deploy/tasks/deploy.yml b/roles/kolla-ansible-deploy/tasks/deploy.yml
new file mode 100644
index 000000000..5b36d7b97
--- /dev/null
+++ b/roles/kolla-ansible-deploy/tasks/deploy.yml
@@ -0,0 +1,55 @@
+---
+- name: Run kolla-ansible prechecks
+  ansible.builtin.shell:
+    cmd: >
+      . {{ kolla_ansible_venv_path }}/bin/activate &&
+      kolla-ansible prechecks
+      -i /etc/kolla/inventory
+      -vvv
+      >/tmp/logs/ansible/deploy-prechecks 2>&1
+
+- name: Run kolla-ansible pull
+  ansible.builtin.shell:
+    cmd: >
+      . {{ kolla_ansible_venv_path }}/bin/activate &&
+      kolla-ansible pull
+      -i /etc/kolla/inventory
+      -vvv
+      >/tmp/logs/ansible/pull 2>&1
+
+- name: Run kolla-ansible deploy
+  ansible.builtin.shell:
+    cmd: >
+      . {{ kolla_ansible_venv_path }}/bin/activate &&
+      kolla-ansible deploy
+      -i /etc/kolla/inventory
+      -vvv
+      >/tmp/logs/ansible/deploy 2>&1
+
+- name: Run kolla-ansible post-deploy
+  ansible.builtin.shell:
+    cmd: >
+      . {{ kolla_ansible_venv_path }}/bin/activate &&
+      kolla-ansible post-deploy
+      -i /etc/kolla/inventory
+      -vvv
+      >/tmp/logs/ansible/post-deploy 2>&1
+
+- name: Run kolla-ansible validate-config on upgrades
+  ansible.builtin.shell:
+    cmd: >
+      . {{ kolla_ansible_venv_path }}/bin/activate &&
+      kolla-ansible validate-config
+      -i /etc/kolla/inventory
+      -vvv
+      >/tmp/logs/ansible/validate-config 2>&1
+  when: not is_upgrade | bool
+
+- name: Run kolla-ansible check
+  ansible.builtin.shell:
+    cmd: >
+      . {{ kolla_ansible_venv_path }}/bin/activate &&
+      kolla-ansible check
+      -i /etc/kolla/inventory
+      -vvv
+      >/tmp/logs/ansible/check 2>&1
diff --git a/roles/kolla-ansible-deploy/tasks/main.yml b/roles/kolla-ansible-deploy/tasks/main.yml
new file mode 100644
index 000000000..e02765d99
--- /dev/null
+++ b/roles/kolla-ansible-deploy/tasks/main.yml
@@ -0,0 +1,11 @@
+---
+- name: Ensure /etc/kolla is writable
+  become: true
+  ansible.builtin.file:
+    path: /etc/kolla
+    state: directory
+    mode: "0777"
+    recurse: true
+
+- import_tasks: certificates.yml
+- import_tasks: deploy.yml
diff --git a/tests/deploy.sh b/tests/deploy.sh
deleted file mode 100755
index 419c4778a..000000000
--- a/tests/deploy.sh
+++ /dev/null
@@ -1,80 +0,0 @@
-#!/bin/bash
-
-set -o xtrace
-set -o errexit
-
-# Enable unbuffered output for Ansible in Jenkins.
-export PYTHONUNBUFFERED=1
-
-function init_pebble {
-
-    sudo echo "[i] Pulling letsencrypt/pebble" > /tmp/logs/ansible/certificates
-    sudo docker pull quay.io/openstack.kolla/pebble:latest &>> /tmp/logs/ansible/certificates
-
-    sudo echo "[i] Force removing old pebble container" &>> /tmp/logs/ansible/certificates
-    sudo docker rm -f pebble &>> /tmp/logs/ansible/certificates
-
-    sudo echo "[i] Run new pebble container" &>> /tmp/logs/ansible/certificates
-    sudo docker run --name pebble --rm -d -e "PEBBLE_VA_NOSLEEP=1" -e "PEBBLE_VA_ALWAYS_VALID=1" --net=host quay.io/openstack.kolla/pebble:latest &>> /tmp/logs/ansible/certificates
-
-    sudo echo "[i] Wait for pebble container be up" &>> /tmp/logs/ansible/certificates
-    # wait until pebble starts
-    while ! sudo docker logs pebble | grep -q "Listening on"; do
-        sleep 1
-    done
-    sudo echo "[i] Wait for pebble container done" &>> /tmp/logs/ansible/certificates
-
-    sudo echo "[i] Pebble container logs" &>> /tmp/logs/ansible/certificates
-    sudo docker logs pebble &>> /tmp/logs/ansible/certificates
-}
-
-function pebble_cacert {
-
-    sudo docker cp pebble:/test/certs/pebble.minica.pem /etc/kolla/certificates/ca/pebble-root.crt
-    sudo curl -k -s -o /etc/kolla/certificates/ca/pebble.crt -v https://127.0.0.1:15000/roots/0
-}
-
-function certificates {
-
-    RAW_INVENTORY=/etc/kolla/inventory
-    source $KOLLA_ANSIBLE_VENV_PATH/bin/activate
-
-    # generate self-signed certificates for the optional internal TLS tests
-    if [[ "$TLS_ENABLED" = "True" ]]; then
-        kolla-ansible certificates -i ${RAW_INVENTORY} -vvv > /tmp/logs/ansible/certificates
-    fi
-    if [[ "$LE_ENABLED" = "True" ]]; then
-        init_pebble
-        pebble_cacert
-    fi
-
-    #TODO(inc0): Post-deploy complains that /etc/kolla is not writable. Probably we need to include become there
-    sudo chmod -R 777 /etc/kolla
-}
-
-
-function deploy {
-
-    RAW_INVENTORY=/etc/kolla/inventory
-    source $KOLLA_ANSIBLE_VENV_PATH/bin/activate
-
-    #TODO(inc0): Post-deploy complains that /etc/kolla is not writable. Probably we need to include become there
-    sudo chmod -R 777 /etc/kolla
-
-    certificates
-
-    # Actually do the deployment
-    kolla-ansible prechecks -i ${RAW_INVENTORY} -vvv &> /tmp/logs/ansible/deploy-prechecks
-    kolla-ansible pull -i ${RAW_INVENTORY} -vvv &> /tmp/logs/ansible/pull
-    kolla-ansible deploy -i ${RAW_INVENTORY} -vvv &> /tmp/logs/ansible/deploy
-    kolla-ansible post-deploy -i ${RAW_INVENTORY} -vvv &> /tmp/logs/ansible/post-deploy
-
-    if [[ $HAS_UPGRADE == 'no' ]]; then
-        kolla-ansible validate-config -i ${RAW_INVENTORY} -vvv &> /tmp/logs/ansible/validate-config
-    fi
-
-    kolla-ansible check -i ${RAW_INVENTORY} -vvv &> /tmp/logs/ansible/check
-}
-
-
-deploy
diff --git a/tests/pre.yml b/tests/pre.yml
index 804c090d1..4f8d4556d 100644
--- a/tests/pre.yml
+++ b/tests/pre.yml
@@ -61,6 +61,7 @@
           - gawk
           - python3-pip
           - python3-setuptools
+          - python3-requests
 
     - name: Install lvm on storage scenarios
       become: true
diff --git a/tests/run.yml b/tests/run.yml
index eca77e215..0b04afa24 100644
--- a/tests/run.yml
+++ b/tests/run.yml
@@ -391,16 +391,8 @@
 
     # Deploy control plane. For upgrade jobs this is the previous release.
     - block:
-        - name: Run deploy.sh script
-          script:
-            cmd: deploy.sh
-            executable: /bin/bash
-            chdir: "{{ kolla_ansible_src_dir }}"
-          environment:
-            TLS_ENABLED: "{{ tls_enabled }}"
-            LE_ENABLED: "{{ le_enabled }}"
-            KOLLA_ANSIBLE_VENV_PATH: "{{ kolla_ansible_venv_path }}"
-            HAS_UPGRADE: "{{ is_upgrade | bool | ternary('yes', 'no') }}"
+        - import_role:
+            name: kolla-ansible-deploy
 
         # NOTE(yoctozepto): this is nice as the first step after the deployment
         # because it waits for the services to stabilize well enough so that
diff --git a/zuul.d/scenarios/aio.yaml b/zuul.d/scenarios/aio.yaml
index 763351fbd..39bbe5f05 100644
--- a/zuul.d/scenarios/aio.yaml
+++ b/zuul.d/scenarios/aio.yaml
@@ -8,6 +8,7 @@
       - ^ansible/(action_plugins|filter_plugins|library|module_utils)/
       - ^ansible/roles/(common|fluentd|glance|haproxy-config|heat|horizon|keystone|loadbalancer|loadbalancer-config|neutron|nova|nova-cell|openvswitch|placement|proxysql|rabbitmq)/
       - ^kolla_ansible/
+      - ^roles/kolla-ansible-deploy/
       - ^tests/test-(core-openstack|dashboard).sh
       - ^tools/init-runonce
 
diff --git a/zuul.d/scenarios/lets-encrypt.yaml b/zuul.d/scenarios/lets-encrypt.yaml
index a985cae64..fc059a79c 100644
--- a/zuul.d/scenarios/lets-encrypt.yaml
+++ b/zuul.d/scenarios/lets-encrypt.yaml
@@ -7,9 +7,9 @@
       - ^ansible/group_vars/all/lets-encrypt.yml
       - ^ansible/roles/fluentd/templates/conf/input/11-letsencrypt.conf.j2
       - ^ansible/roles/(haproxy-config|letsencrypt|loadbalancer|loadbalancer-config)/
+      - ^roles/kolla-ansible-deploy/tasks/certificates.yml
       - ^tests/test-core-openstack.sh
       - ^tests/test-dashboard.sh
-      - ^tests/deploy.sh
     vars:
       scenario: lets-encrypt
       scenario_images_extra: