[octane] Upgrade second and third controllers separately fails at "installing openstack" part

[Andrey Volochay]

Detailed bug description:
 During upgrade MOS6.0 to MOS8.0 via Octane(stable/8.0), I have faced with following bug.

 By doing second and third controllers upgrade via Octane (octane upgrade-node <target_node_id> <seed_env_id>), deployment failed at "installing openstack" part.

 Could not evaluate: Primitive 'p_dns' was not found in CIB!

Steps to reproduce:
 1) Have MOS6.0 environment
 2) Upgrade master node (fuel 6.0) to 6.1 and then to 7.0
 3) Backup environment settings, following documented process
 4) Prepare new master node (fuel 8.0)
 5) Restore the backup from third step
 5) Upgrade restored environment via Octane
 6) Upgrade primary controller via Octane
 7) Upgrade DB via Octane
 8) Upgrade Control Plane via Octane
 9) Upgrade second controller
10) Upgrade third controller

Expected results:
 Upgrade of second and third controllers is successfully done

Actual result:
 Puppet apply returns an error which in turn breaks node upgrade.

Reproducibility:
 When you upgrade controllers one by one, but not the both at one time.

Workaround:
 Add records about second and third controllers in corosync.conf at primary-controller before their upgrade.

Description of the environment:
 Versions of components: MOS8.0, Octane(stable/8.0)
 Network model: Environment uses network bonding
 Related projects installed: Octane

Additional information:
 it happens in octane/commands/upgrade_node.py

 if isolated or len(nodes) == 1:
     env_util.deploy_nodes(env, nodes)
 else:
     env_util.deploy_changes(env, nodes)

 It's unsafe to manage controllers upgrade via count of nodes that are upgraded. Node's role should be the criterion.

[Oleg S. Gelbukh (gelbuhos)]

Upgrade of secondary controllers one by one never worked. I think it is even reflected in the docs somewhere. We could extend the validations to exclude this possibility, I think.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/321599

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/321599
Committed: https://git.openstack.org/cgit/openstack/fuel-octane/commit/?id=6111d9b9de10b583c5a1699edcd0994e55a739e3
Submitter: Jenkins
Branch: master

commit 6111d9b9de10b583c5a1699edcd0994e55a739e3
Author: Oleg Gelbukh <email address hidden>
Date: Thu May 26 14:54:41 2016 +0000

    Validate nodes roles to exclude upgrade of single controller

    The proper sequence to upgrade controllers is:

    - upgrade primary controller in isolation
    - cut over to the new control plane
    - upgrade remaining controllers at once

    To exclude the possibility to upgrade single controller after
    the cutover, add validation of roles of nodes to upgrade and
    stop if the only node passed to the script is a CIC.

    Change-Id: Ie91ae35acb7e36103004a59c92cb495837e0dca0
    Closes-bug: 1584656

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/332931

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/332931
Committed: https://git.openstack.org/cgit/openstack/fuel-octane/commit/?id=24f3c396612eb0c69fbf06bab3cebbb9ca829426
Submitter: Jenkins
Branch: stable/mitaka

commit b34d749f1c281dafbdbf155bd86830dc8f2a9aa2
Author: Ilya Kharin <email address hidden>
Date: Wed Jun 22 21:10:56 2016 +0300

    Support mock==1.8.0 in unit tests

    Use assert_called_once_with instead of assert_called_once that was
    introduced in 2.0.0.

    Change-Id: Ifb7699d4b552d148984961727355f0e23b487c7c

commit d60f1905143bb7576ffd670595de1c4aeafd7b34
Author: Ilya Kharin <email address hidden>
Date: Wed Jun 22 02:01:52 2016 +0300

    Allow to authorize by the predefined admin_token

    The admin_token_auth middleware is added to keystone pipelines to
    allow authorization by admin_token.

    Change-Id: Ic03150305a669fad1446436a68051fb9aa25b892

commit cc7fab59f44ffef60285f8732d798f52469b2530
Author: Ilya Kharin <email address hidden>
Date: Wed Jun 22 01:47:01 2016 +0300

    Reset default_domain_id before the keystone task

    The default_domain_id should be removed from keystone.conf after restore
    of DB and before to apply the keystone puppet task to avoid of using the
    configured domain as a default.

    Change-Id: I05a6c48532e8042496b3d8ccef53d65bf8c44653

commit e3f82399d567dbcfc1ae9a1ecbddba7bf5028fc8
Author: Ilya Kharin <email address hidden>
Date: Wed Jun 22 01:32:47 2016 +0300

    Add helper function to iterate over parameters

    The helpers.iterate_parameters function allows to iterate over lines of
    INI-like files along with a context of information, such section,
    parameter and value.

    Change-Id: I55b179118116fd5dacf100754057ea6589782dc2

commit 5ed370a4fbb3369d0f75873d205ac7f0c655f93a
Author: Ilya Kharin <email address hidden>
Date: Wed Jun 22 01:18:05 2016 +0300

    Add update_file context manager for local files

    The subprocess.update_file function provides an ability to update
    content of a local file by iterating over lines of an original file and
    forming a result content in a temporary file to replace the original
    file in the end. This function is very useful to change configuration
    files.

    Change-Id: I433a5da67887b231400dd63131799019f45c277c

commit 58f31e6c5f408630c42565ee53de6b59457bc84c
Author: Oleg Gelbukh <email address hidden>
Date: Wed Jun 22 14:34:03 2016 +0000

    Escape passwords passed to openstack client

    If special symbols are used in password for 'admin' user in
    OpenStack, octane passes them to command line client as is
    and it breaks shell.

    Properly escape the password before passing it to subprocess.

    Change-Id: Iad635aec6d5b5cc32975937e00205b7e89dc99d9
    Closes-bug: 1585960

commit 896aba1191eeb59cf85cc8be6a2ae67e08b76070
Author: Yuriy Taraday <email address hidden>
Date: Wed Jun 22 15:28:45 2016 +0300

    Add absolute_import to util/docker.py to avoid local tempfile module

    Closes-Bug: 1595156
    Change-Id: I9484efce6fa7aec1b41cf592f9e9768d85931fa7

commit 46586a62df962b2ce00b5d8a63f6fd34c920a1f4
Author: Oleg Gelbukh <email address hidden>
Date: Thu M...