Ocata -> Pike overcloud upgrade: when migrating to containers we should remove the rpm packages from host

[Marius Cornea]

During upgrade all packages on the host get updated including the ones for services which are migrated to containers. Since these packages aren't required any longer on the host we should remove them or expose an option for the user to remove or keep them. yum update could take quite a bit and we can save precious time by not updating packages which are not needed.

[Bogdan Dobrelya (bogdando)]

great point, from a security perspective especially!

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/479886

[Marios Andreou (marios-b)]

having a look here as discussed earlier today - posted a WIP for the nova-api service at https://review.openstack.org/479886 WIP: Remove package if service stopped and disabled

[Marios Andreou (marios-b)]

Note this is also discussed at https://bugzilla.redhat.com/show_bug.cgi?id=1470041

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/479886
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=ce0ef2fa207698c1ae61c1620fe3c5e8d1c7bfca
Submitter: Jenkins
Branch: master

commit ce0ef2fa207698c1ae61c1620fe3c5e8d1c7bfca
Author: marios <email address hidden>
Date: Mon Jul 3 19:20:30 2017 +0300

    Remove package if service stopped and disabled

    Adds a UpgradeRemoveUnusedPackages param to use
    in the ansible when conditional for the removal

    Adds package removal to step2 right after a service
    is stopped and disabled on step2. Package updates
    happen in step3 so ideally remove before that.

    The package removal task has ignore_errors true
    so dependencies or other issue removing packages will
    not fail the upgrade workflow.

    Also adds this to the upgrade environment files
    for visibility and defaulting false

    Change-Id: Ie4e4a2d41f7752c5a13507a7c15c6f68e203cfca
    Related-Bug: 1701501

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/pike
Review: https://review.openstack.org/510545

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/510545
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=6d150b03cff457bf43e8c2b55ba03ace20d6c244
Submitter: Jenkins
Branch: stable/pike

commit 6d150b03cff457bf43e8c2b55ba03ace20d6c244
Author: marios <email address hidden>
Date: Mon Jul 3 19:20:30 2017 +0300

    Remove package if service stopped and disabled

    Adds a UpgradeRemoveUnusedPackages param to use
    in the ansible when conditional for the removal

    Adds package removal to step2 right after a service
    is stopped and disabled on step2. Package updates
    happen in step3 so ideally remove before that.

    The package removal task has ignore_errors true
    so dependencies or other issue removing packages will
    not fail the upgrade workflow.

    Also adds this to the upgrade environment files
    for visibility and defaulting false

    Change-Id: Ie4e4a2d41f7752c5a13507a7c15c6f68e203cfca
    Related-Bug: 1701501
    (cherry picked from commit ce0ef2fa207698c1ae61c1620fe3c5e8d1c7bfca)

[Marios Andreou (marios-b)]

As discussed at https://bugzilla.redhat.com/show_bug.cgi?id=1470041#c6 we need to stop and remove the object-expirer service together with the swift proxy service. The expirer service is provided by the swift-proxy package so we need to stop them at the same time.

If you set the UpgradeRemoveUnusedPackages then the upgrade fails with:

    failed: [localhost] (item=openstack-swift-object-expirer) => {"changed": false, "failed": true, "item": "openstack-swift-object-expirer", "msg": "Could not find the requested service openstack-swift-object-expirer: host"}

because the swift-proxy package has already been removed

Nov 21 09:04:48 localhost os-collect-config: ok: [localhost]
Nov 21 09:04:48 localhost os-collect-config: TASK [Stop and disable swift_proxy service] ************************************
Nov 21 09:04:48 localhost os-collect-config: changed: [localhost]
Nov 21 09:04:48 localhost os-collect-config: TASK [Remove openstack-swift-proxy package if operator requests it] ************
Nov 21 09:04:48 localhost os-collect-config: changed: [localhost]
Nov 21 09:04:48 localhost os-collect-config: TASK [Stop and disable swift storage services] *********************************
Nov 21 09:04:48 localhost os-collect-config: changed: [localhost] => (item=openstack-swift-account-auditor)
Nov 21 09:04:48 localhost os-collect-config: changed: [localhost] => (item=openstack-swift-account-reaper)
Nov 21 09:04:48 localhost os-collect-config: changed: [localhost] => (item=openstack-swift-account-replicator)
Nov 21 09:04:48 localhost os-collect-config: changed: [localhost] => (item=openstack-swift-account)
Nov 21 09:04:48 localhost os-collect-config: changed: [localhost] => (item=openstack-swift-container-auditor)
Nov 21 09:04:48 localhost os-collect-config: changed: [localhost] => (item=openstack-swift-container-replicator)
Nov 21 09:04:48 localhost os-collect-config: changed: [localhost] => (item=openstack-swift-container-updater)
Nov 21 09:04:48 localhost os-collect-config: changed: [localhost] => (item=openstack-swift-container)
Nov 21 09:04:48 localhost os-collect-config: changed: [localhost] => (item=openstack-swift-object-auditor)
Nov 21 09:04:48 localhost os-collect-config: failed: [localhost] (item=openstack-swift-object-expirer) => {"changed": false, "failed": true, "item": "openstack-swift-object-expirer", "msg": "Could not find the requested service openstack-swift-object-expirer: host"}
Nov 21 09:04:48 localhost os-collect-config: changed: [localhost] => (item=openstack-swift-object-replicator)
Nov 21 09:04:48 localhost os-collect-config: changed: [localhost] => (item=openstack-swift-object-updater)
Nov 21 09:04:48 localhost os-collect-config: changed: [localhost] => (item=openstack-swift-object)
Nov 21 09:04:48 localhost os-collect-config: to retry, use: --limit @/var/lib/heat-config/heat-config-ansible/8020c133-78f4-4b77-b5f4-1c2251c21317_playbook.retry
Nov 21 09:04:48 localhost os-collect-config: PLAY RECAP *********************************************************************
Nov 21 09:04:48 localhost os-collect-config: localhost : ok=75 changed=59 unreachable=0 failed=1

Will post something momentarily

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/521914

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/pike
Review: https://review.openstack.org/521917

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/521914
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=b3d1d45ba5cd0d608b514cca9aaa53eb6ddc45e8
Submitter: Zuul
Branch: master

commit b3d1d45ba5cd0d608b514cca9aaa53eb6ddc45e8
Author: marios <email address hidden>
Date: Tue Nov 21 17:37:48 2017 +0200

    Stop the object-expirer service before removing swift-proxy

    As discussed in the bug below, the expirer service is provided
    by the swift-proxy package so it needs to be stopped at the
    same time as swift-proxy and not with the other swift services

    Change-Id: I01518f82cef494682b4359ba7849ba7e37ac39cc
    Related-Bug: 1701501

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/521917
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=f7fa96c2e1330a10c2aee478fb6285bc69af1415
Submitter: Zuul
Branch: stable/pike

commit f7fa96c2e1330a10c2aee478fb6285bc69af1415
Author: marios <email address hidden>
Date: Tue Nov 21 17:37:48 2017 +0200

    Stop the object-expirer service before removing swift-proxy

    As discussed in the bug below, the expirer service is provided
    by the swift-proxy package so it needs to be stopped at the
    same time as swift-proxy and not with the other swift services

    Change-Id: I01518f82cef494682b4359ba7849ba7e37ac39cc
    Related-Bug: 1701501
    (cherry picked from commit b3d1d45ba5cd0d608b514cca9aaa53eb6ddc45e8)