Security: Disable role during major version upgrades

[Major Hayden]

Upgrading between major versions of OpenStack services, such as Kilo to Liberty, or Liberty to Mitaka, can be challenging. We should advise deployers to consider disabling the openstack-ansible-security role during an upgrade to reduce the domain of things to troubleshoot during an upgrade.

This should be in the docs, the upgrade scripts, or both.

[Jean-Philippe Evrard (jean-philippe-evrard)]

I'll start with a doc change.

If this requires more work, feel free to add another commit to it.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/311202

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: liberty
Review: https://review.openstack.org/311211

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/311215

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/311215
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible/commit/?id=51441fef44e69ef2e79926c86b9a8234214be6e2
Submitter: Jenkins
Branch: master

commit 51441fef44e69ef2e79926c86b9a8234214be6e2
Author: Jean-Philippe Evrard <email address hidden>
Date: Fri Apr 29 18:57:58 2016 +0100

    Disable security role during major upgrades

    This commit disables the security hardening role during major
    upgrades by creating a temporary file. It removes the file after
    a sucessful upgrade.

    Change-Id: Ib32e0e317a84a443fb7fc9d3a364a16bd469b6e3
    Closes-Bug: #1568029

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/311211
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible/commit/?id=11a270d99a7def6fb65047f2f6b08b8304d6200f
Submitter: Jenkins
Branch: liberty

commit 11a270d99a7def6fb65047f2f6b08b8304d6200f
Author: Jean-Philippe Evrard <email address hidden>
Date: Fri Apr 29 18:43:19 2016 +0100

    Doc: Notice to disable security role during major upgrades

    This commit explains the process to disable the security hardening role
    for the major upgrades.

    Change-Id: I26f956d670343f66d06aa0266bfa5c7256231e2f
    Closes-Bug: #1568029

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/311202
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible/commit/?id=12f0c6898312544294e477979053fcafc631e6da
Submitter: Jenkins
Branch: master

commit 12f0c6898312544294e477979053fcafc631e6da
Author: Jean-Philippe Evrard <email address hidden>
Date: Fri Apr 29 18:18:58 2016 +0100

    Doc: Notice to disable security hardening role during minor upgrades

    Change-Id: I9d6adbe293543f953b0fd8b94b94cf21e914cc0b
    Closes-Bug: #1568029

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/openstack-ansible 12.0.13 release.

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/openstack-ansible 14.0.0.0b1 development milestone.

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/openstack-ansible 14.0.0.0b2 development milestone.