From 6b94bdb78dec4ef34bf03f41ef6183c88f542a88 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 6 Dec 2022 11:52:35 +1100
Subject: [PATCH] install-ansible: update venv once a day

In reviews for I3696740112fa691d1700040b557f53f6721393e7 clarkb
correctly pointed out that a constraint like ansible<8 will never
result in the production venv being updated.

The point of having the requirements.txt was to avoid a full update
run on the venv on every one of its frequent runs.

A good in-between seems to be writing out the current day timestamp
into the requirements file.  Since the template: return value is based
on comparing the hash of the old/new (we suspected this, but I also
double confirmed with a local test), this results in the template
being updated just once a day.  Ergo we will run a --update run on the
ansible-venv just once a day.

Change-Id: I78a914f71cef687f09fcfee0f3f498b79d810f5d
---
 playbooks/roles/install-ansible/tasks/main.yaml      | 12 +++++++++++-
 .../install-ansible/templates/requirements.txt.j2    |  1 +
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/playbooks/roles/install-ansible/tasks/main.yaml b/playbooks/roles/install-ansible/tasks/main.yaml
index 5cd94183b3..23fdfc0381 100644
--- a/playbooks/roles/install-ansible/tasks/main.yaml
+++ b/playbooks/roles/install-ansible/tasks/main.yaml
@@ -45,6 +45,15 @@
   vars:
     create_venv_path: '/usr/ansible-venv'
 
+# The boostrap job runs this all the time, and we'd like to skip
+# trying to update the venv mostly.  But we also want to have things
+# like ansible specify '<X' so we pick up point releases.  By writing
+# the current day into the requirements.txt, the template updates once
+# a day, and thus we update the venv just once a day.
+- name: Get current day
+  shell: 'date +%Y-%m-%d'
+  register: _date
+
 - name: Write out requirements file
   template:
     src: requirements.txt.j2
@@ -59,7 +68,8 @@
   pip:
     requirements: '/usr/ansible-venv/requirements.txt'
     virtualenv: '/usr/ansible-venv'
-    # If the requirements.txt has changed, force things to upgrade
+    # Always upgrade because only called in response to
+    # requirements.txt changes.
     extra_args: '--upgrade'
 
 # From Ansible 2.10 >= most of the fun stuff is in collections.  Clone
diff --git a/playbooks/roles/install-ansible/templates/requirements.txt.j2 b/playbooks/roles/install-ansible/templates/requirements.txt.j2
index bd874beeee..0c83457c2c 100644
--- a/playbooks/roles/install-ansible/templates/requirements.txt.j2
+++ b/playbooks/roles/install-ansible/templates/requirements.txt.j2
@@ -1,3 +1,4 @@
+# Update timestamp: {{ _date.stdout }}
 {% for r in install_ansible_requirements %}
 {{ r }}
 {% endfor %}