upper_constraints not found when requirements SHA updated

[Dmitriy Rabotyagov]

Description:

In case deployer updates requirements_git_install_branch, he requires to re-run repo_server role, because contraints are cached on repo server.

Otherwise python_venv_build will fail with:

```
TASK [python_venv_build : Upgrade the wheel build virtualenv pip/setuptools/wheel to the versions we want] ********************************************************************************
FAILED - RETRYING: Upgrade the wheel build virtualenv pip/setuptools/wheel to the versions we want (5 retries left).
FAILED - RETRYING: Upgrade the wheel build virtualenv pip/setuptools/wheel to the versions we want (4 retries left).
FAILED - RETRYING: Upgrade the wheel build virtualenv pip/setuptools/wheel to the versions we want (3 retries left).
FAILED - RETRYING: Upgrade the wheel build virtualenv pip/setuptools/wheel to the versions we want (2 retries left).
FAILED - RETRYING: Upgrade the wheel build virtualenv pip/setuptools/wheel to the versions we want (1 retries left).
fatal: [aio1_glance_container-d135d358 -> 172.29.236.186]: FAILED! => {"attempts": 5, "changed": false, "cmd": ["/openstack/venvs/wheel-builder-python3/bin/pip3", "install", "-U", "--constraint", "/var/www/repo/os-releases/23.1.0.dev43/ubuntu-20.04-x86_64/requirements/glance-23.1.0.dev43-global-constraints.txt", "--constraint", "/var/www/repo/os-releases/23.1.0.dev43/ubuntu-20.04-x86_64/requirements/glance-23.1.0.dev43-source-constraints.txt", "--find-links", "/var/www/repo/os-releases/23.1.0.dev43/ubuntu-20.04-x86_64/wheels/", "--log", "/var/log/python_venv_build.log", "pip", "setuptools", "wheel"], "msg": "\n:stderr: ERROR: 404 Client Error: Not Found for url: http://172.29.236.101:8181/constraints/upper_constraints_863eea3390630f9e226367d4ade1c2ebd5c2a216.txt\n"}
```

We need to resolve that one way or another. Among possible solutions I see right now:

- Add some block/rescue around https://opendev.org/openstack/ansible-role-python_venv_build/src/branch/master/tasks/python_venv_wheel_build.yml#L106-L125 to either include repo_server role with tasks_from https://opendev.org/openstack/openstack-ansible-repo_server/src/branch/master/tasks/repo_install_constraints.yml or just copy/paste tasks to ensure that u-c file exists on the repo server. Instead of block/rescue we can force check of requirements during venv_rebuild process.
- Change somehow naming logic of upper_constraints and name it with osa version instead of the SHA. But this will result in old constraints being applied instead of the error, which might be even worse
- By default diable caching and implement another variable that will control if caching is enabled or not. With that we add a doc page that describes behaviour and consequences.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/openstack-ansible-repo_server/+/842567

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/openstack-ansible/+/842571

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/openstack-ansible-repo_server/+/842567
Committed: https://opendev.org/openstack/openstack-ansible-repo_server/commit/a5df0d1a9bd4f4a24b578ae0596890f7b345381a
Submitter: "Zuul (22348)"
Branch: master

commit a5df0d1a9bd4f4a24b578ae0596890f7b345381a
Author: Dmitriy Rabotyagov <email address hidden>
Date: Thu May 19 18:22:00 2022 +0200

    Have a symlink to u_c versioned file

    With current behavior of u-c file that is stored on repo server and
    migration to shared FS instead of lsyncd, we don't have any reliable
    path to check for.

    Also we have issue, that with updated u-c SHA users catch "unrelated"
    error in python_venv_build role.

    As a solution, we can create a symlink to the u-c file, that will have
    persistant name and be updated with repo_server role run.

    That would give us both file to verify and it can be used as u-c URI.

    Change-Id: Ie7bdb9137ed69be465f014fa811b750dbec4e428
    Related-Bug: #1943978

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/openstack-ansible/+/842571
Committed: https://opendev.org/openstack/openstack-ansible/commit/f67370f568abd72564e8f3de8982703e6bfac63b
Submitter: "Zuul (22348)"
Branch: master

commit f67370f568abd72564e8f3de8982703e6bfac63b
Author: Dmitriy Rabotyagov <email address hidden>
Date: Thu May 19 18:32:39 2022 +0200

    Update repo verification file URI

    Since we're creating a symlink to the U-C file to have a consistent
    filename for it, it makes sense to verify this file for simplicity.
    With migration to gluster we also should change verification URI
    for HaProxy, which we also set to u-c link.

    With that we also somehow solve issue when u-c can't be fetched when SHA
    is updated, but repo-server role wasn't re-ran.

    Closes-Bug: #1943978
    Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-repo_server/+/842567
    Change-Id: I23ac2ec3246cbae50d30815fbd3bdcc4da7d7089

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-ansible 25.0.0.0b1 development milestone.