install-ansible: update venv once a day

In reviews for I3696740112fa691d1700040b557f53f6721393e7 clarkb
correctly pointed out that a constraint like ansible<8 will never
result in the production venv being updated.

The point of having the requirements.txt was to avoid a full update
run on the venv on every one of its frequent runs.

A good in-between seems to be writing out the current day timestamp
into the requirements file.  Since the template: return value is based
on comparing the hash of the old/new (we suspected this, but I also
double confirmed with a local test), this results in the template
being updated just once a day.  Ergo we will run a --update run on the
ansible-venv just once a day.

Change-Id: I78a914f71cef687f09fcfee0f3f498b79d810f5d

playbooks/roles/install-ansible/tasks/main.yaml

@@ -45,6 +45,15 @@
   vars:
     create_venv_path: '/usr/ansible-venv'
 
+# The boostrap job runs this all the time, and we'd like to skip
+# trying to update the venv mostly.  But we also want to have things
+# like ansible specify '<X' so we pick up point releases.  By writing
+# the current day into the requirements.txt, the template updates once
+# a day, and thus we update the venv just once a day.
+- name: Get current day
+  shell: 'date +%Y-%m-%d'
+  register: _date
+
 - name: Write out requirements file
   template:
     src: requirements.txt.j2
@@ -59,7 +68,8 @@
   pip:
     requirements: '/usr/ansible-venv/requirements.txt'
     virtualenv: '/usr/ansible-venv'
-    # If the requirements.txt has changed, force things to upgrade
+    # Always upgrade because only called in response to
+    # requirements.txt changes.
     extra_args: '--upgrade'
 
 # From Ansible 2.10 >= most of the fun stuff is in collections.  Clone

playbooks/roles/install-ansible/templates/requirements.txt.j2

@@ -1,3 +1,4 @@
+# Update timestamp: {{ _date.stdout }}
 {% for r in install_ansible_requirements %}
 {{ r }}
 {% endfor %}