Handle moved puppet repos

As per [1], it seems puppet has "cleaned up" most of the packages we
are using to install.

Install the puppet-agent packages directly as puppet's archive location
is not a valid repo. With puppet 4 at least these packages should bundle
everything we need including ruby.

[1] https://groups.google.com/forum/#!msg/puppet-users/cCsGWKunBe4/OdG0T7LeDAAJ

Depends-On: https://review.opendev.org/659384
Depends-On: https://review.opendev.org/659395
Change-Id: Ie9e2b79b42f397bddd960ccdc303b536155ce123

.zuul.yaml

@@ -262,20 +262,6 @@
     files:
       - roles/.*
 
-- job:
-    name: system-config-zuul-role-integration-trusty
-    parent: system-config-zuul-role-integration
-    nodeset:
-      nodes:
-        - name: base
-          label: ubuntu-trusty
-        - name: puppet4
-          label: ubuntu-trusty
-      groups:
-        - name: puppet3
-          nodes:
-            - base
-
 - job:
     name: system-config-zuul-role-integration-xenial
     parent: system-config-zuul-role-integration
@@ -314,13 +300,11 @@
     name: system-config-zuul-role-integration
     check:
       jobs:
-        - system-config-zuul-role-integration-trusty
         - system-config-zuul-role-integration-xenial
         - system-config-zuul-role-integration-bionic
         - system-config-zuul-role-integration-debian-stable
     gate:
       jobs:
-        - system-config-zuul-role-integration-trusty
         - system-config-zuul-role-integration-xenial
         - system-config-zuul-role-integration-bionic
         - system-config-zuul-role-integration-debian-stable

playbooks/install_puppet.yaml

@@ -0,0 +1,5 @@
+- hosts: all
+  name: "Install puppet"
+  gather_facts: yes
+  roles:
+    - puppet-install

roles/puppet-install/tasks/puppet-install/CentOS.yaml

@@ -8,7 +8,7 @@
   block:
     - name: Install puppetlabs repo
       yum:
-        name: https://yum.puppetlabs.com/puppetlabs-release-el-7.noarch.rpm
+        name: https://release-archives.puppet.com/yum/puppetlabs-release-el-7.noarch.rpm
 
     - name: Install puppet packages
       yum:
@@ -22,14 +22,14 @@
   when: puppet_install_version == 4
   become: true
   block:
-    - name: Install puppetlabs repo
-      yum:
-        name: https://yum.puppetlabs.com/puppetlabs-release-pc1-el-7.noarch.rpm
-
+    # Puppetlabs removed the puppet4/PC1 repo and shoved the rpms into an
+    # archive. Install the agent rpm directly as a result
+    - name: "Check for puppet 4 install"
+      stat:
+        path: /opt/puppetlabs
+      register: puppet4_installed
     - name: Install puppet packages
       yum:
-        name:
-          - puppet-agent
-          - ruby
+        name: https://release-archives.puppet.com/yum/el/7/PC1/x86_64/puppet-agent-1.10.14-1.el7.x86_64.rpm
         state: present
-        update_cache: yes
+      when: not puppet4_installed.stat.exists

roles/puppet-install/tasks/puppet-install/trusty.yaml

@@ -11,7 +11,7 @@
     # at this point.
     - name: Install puppetlabs repo
       apt:
-        deb: http://apt.puppetlabs.com/puppetlabs-release-trusty.deb
+        deb: http://release-archives.puppet.com/apt/pool/trusty/puppet/p/puppet-release/puppet-release_1.0.0-3trusty_all.deb
 
     - name: Install puppet packages
       package:
@@ -25,29 +25,16 @@
   become: true
   block:
 
-    # The puppetlabs-release-pc1 deb install below unfortunatley isn't
-    # idempotent.  If you install the puppet repo with this deb and
-    # then upgrade, you pull in a new version of
-    # puppetlabs-release-pc1 ... now ansible gets upset because we're
-    # trying to downgrade the package.  This could be fixed by puppet
-    # symlinking the version at the top-level to the latest .deb
-    # ... or we just skip installing it if we seem to have the repo
-    # already.
-    - name: "Check for puppet 4 repo"
+    # Puppetlabs removed the puppet4/PC1 repo and shoved the debs into an
+    # archive. Install the agent deb directly as a result
+    - name: "Check for puppet 4 install"
       stat:
-        path: /etc/apt/sources.list.d/puppetlabs-pc1.list
-      register: puppet4_repo
-    - name: Install puppetlabs repo
+        path: /opt/puppetlabs
+      register: puppet4_installed
+    - name: Install puppet 4
       apt:
-        deb: http://apt.puppetlabs.com/puppetlabs-release-pc1-trusty.deb
-      when: not puppet4_repo.stat.exists
-
-    - name: Install puppet packages
-      apt:
-        name:
-          - puppet-agent
-          - ruby
-        update_cache: yes
+        deb: https://release-archives.puppet.com/apt/pool/trusty/PC1/p/puppet-agent/puppet-agent_1.10.14-1trusty_amd64.deb
+      when: not puppet4_installed.stat.exists
 
 - name: Stop and disable puppet service
   service:

roles/puppet-install/tasks/puppet-install/xenial.yaml

@@ -20,29 +20,16 @@
   become: true
   block:
 
-    # The puppetlabs-release-pc1 deb install below unfortunatley isn't
-    # idempotent.  If you install the puppet repo with this deb and
-    # then upgrade, you pull in a new version of
-    # puppetlabs-release-pc1 ... now ansible gets upset because we're
-    # trying to downgrade the package.  This could be fixed by puppet
-    # symlinking the version at the top-level to the latest .deb
-    # ... or we just skip installing it if we seem to have the repo
-    # already.
-    - name: "Check for puppet 4 repo"
+    # Puppetlabs removed the puppet4/PC1 repo and shoved the debs into an
+    # archive. Install the agent deb directly as a result
+    - name: "Check for puppet 4 install"
       stat:
-        path: /etc/apt/sources.list.d/puppetlabs-pc1.list
-      register: puppet4_repo
-    - name: Install puppetlabs repo
+        path: /opt/puppetlabs
+      register: puppet4_installed
+    - name: Install puppet 4
       apt:
-        deb: https://apt.puppetlabs.com/puppetlabs-release-pc1-xenial.deb
-      when: not puppet4_repo.stat.exists
-
-    - name: Install puppet packages
-      apt:
-        name:
-          - puppet-agent
-          - ruby
-        update_cache: yes
+        deb: https://release-archives.puppet.com/apt/pool/xenial/PC1/p/puppet-agent/puppet-agent_1.10.14-1xenial_amd64.deb
+      when: not puppet4_installed.stat.exists
 
 - name: Stop and disable puppet service
   service:

run_all.sh

@@ -78,15 +78,6 @@ start_timer
 timeout -k 2m 10m ansible-playbook ${ANSIBLE_PLAYBOOKS}/bridge.yaml
 send_timer bridge
 
-# Update the puppet version
-# We run this before base because base enforces the specified puppet version
-# but does not transition from an older version to a newer version.
-# This playbook will do the transition if necessary then base will enforce
-# it going forward.
-start_timer
-timeout -k 2m 10m ansible-playbook -f 50 ${ANSIBLE_PLAYBOOKS}/update_puppet_version.yaml
-send_timer update_puppet_version
-
 # Run the base playbook everywhere
 start_timer
 timeout -k 2m 120m ansible-playbook -f 50 ${ANSIBLE_PLAYBOOKS}/base.yaml

tools/prep-apply.sh

@@ -40,8 +40,15 @@ declare -A INTEGRATION_MODULES
 
 source $MODULE_ENV_FILE
 
+virtualenv --system-site-packages /tmp/apply-ansible-env
+/tmp/apply-ansible-env/bin/pip install ansible
 # Install puppet
-SETUP_PIP=false sudo -E bash -x $ROOT/install_puppet.sh
+inv=`mktemp`
+cat > $inv <<EOF
+localhost ansible_connection=local
+EOF
+sudo -H ANSIBLE_ROLES_PATH=$ROOT/roles /tmp/apply-ansible-env/bin/ansible-playbook -i $inv -e "{\"puppet_install_version\":$PUPPET_VERSION}" $ROOT/playbooks/install_puppet.yaml
+rm $inv
 if [ "$PUPPET_VERSION" == "3" ] ; then
     export MODULE_PATH=/etc/puppet/modules
 elif [ "$PUPPET_VERSION" == "4" ] ; then
@@ -90,5 +97,3 @@ sudo ln -sf $(pwd) /opt/system-config/production
 sudo ln -sf /opt/system-config/production/modules/openstack_project $MODULE_PATH
 sudo -H mkdir -p ~/.ansible/tmp
 
-virtualenv --system-site-packages /tmp/apply-ansible-env
-/tmp/apply-ansible-env/bin/pip install ansible