Cleanup/standardize usage of tags

The numerous tags within the role have been condensed
to two tags: keystone-install and keystone-config

These tags have been chosen as they are namespaced
and cover the two major functions of the role.

Documentation has been updated to inform how each tag
influences the function of the role.

Change-Id: Iea4bff944ce0a35a4b1bc044171472ea44eda323

README.rst

@@ -65,3 +65,13 @@ Example Playbook
         keystone_rabbitmq_servers: 10.100.100.101
         keystone_rabbitmq_use_ssl: true
         galera_client_drop_config_file: false
+
+Tags
+====
+
+This role supports two tags: ``keystone-install`` and ``keystone-config``
+
+The ``keystone-install`` tag can be used to install and upgrade.
+
+The ``keystone-config`` tag can be used to maintain configuration of the
+service.

tasks/keystone_apache.yml

@@ -25,8 +25,6 @@
     - { src: "keystone-httpd-mpm.conf.j2", dest: "/etc/apache2/mods-available/mpm_{{ keystone_httpd_mpm_backend }}.conf" }
   notify:
     - Restart Apache
-  tags:
-    - keystone-httpd
 
 - name: Disable default apache site
   file:
@@ -34,8 +32,6 @@
     state: "absent"
   notify:
     - Restart Apache
-  tags:
-    - keystone-httpd
 
 - name: Enabled keystone vhost
   file:
@@ -44,8 +40,6 @@
     state: "link"
   notify:
     - Restart Apache
-  tags:
-    - keystone-httpd
 
 - name: Ensure Apache ServerName
   lineinfile:
@@ -53,8 +47,6 @@
     line: "ServerName {{ ansible_hostname }}"
   notify:
     - Restart Apache
-  tags:
-    - keystone-httpd
 
 - name: Ensure Apache ServerTokens
   lineinfile:
@@ -63,8 +55,6 @@
     line: "ServerTokens {{ keystone_apache_servertokens }}"
   notify:
     - Restart Apache
-  tags:
-    - keystone-httpd
 
 - name: Ensure Apache ServerSignature
   lineinfile:
@@ -73,8 +63,6 @@
     line: "ServerSignature {{ keystone_apache_serversignature }}"
   notify:
     - Restart Apache
-  tags:
-    - keystone-httpd
 
 - name: Enable/disable mod_ssl for apache2
   apache2_module:
@@ -82,9 +70,6 @@
     state: "{{ (keystone_ssl | bool) | ternary('present', 'absent') }}"
   notify:
     - Restart Apache
-  tags:
-    - keystone-httpd
-    - keystone-ssl
 
 - name: Enable/disable mod_shib2 for apache2
   apache2_module:
@@ -93,5 +78,3 @@
   ignore_errors: yes
   notify:
     - Restart Apache
-  tags:
-    - keystone-httpd

tasks/keystone_db_setup.yml

@@ -17,8 +17,3 @@
   command: "{{ keystone_bin }}/keystone-manage db_sync"
   become: yes
   become_user: "{{ keystone_system_user_name }}"
-  tags:
-    - keystone-db-setup
-    - keystone-db-sync
-    - keystone-setup
-    - keystone-command-bin

tasks/keystone_federation_sp_idp_setup.yml

@@ -21,8 +21,6 @@
 - name: Set keystone_federated_identities fact
   keystone_sp:
     sp_data: "{{ keystone_sp }}"
-  tags:
-    - keystone-federation-sp
 
 - name: Ensure domain which remote IDP users are mapped onto exists
   keystone:
@@ -35,8 +33,6 @@
     insecure: "{{ keystone_service_adminuri_insecure }}"
   when: item.domain is defined
   with_items: keystone_federated_identities
-  tags:
-    - keystone-federation-sp
 
 - name: Ensure project which remote IDP users are mapped onto exists
   keystone:
@@ -50,8 +46,6 @@
     insecure: "{{ keystone_service_adminuri_insecure }}"
   when: item.project is defined
   with_items: keystone_federated_identities
-  tags:
-    - keystone-federation-sp
 
 - name: Ensure user which remote IDP users are mapped onto exists
   keystone:
@@ -70,8 +64,6 @@
     item.password is defined and
     item.project is defined
   with_items: keystone_federated_identities
-  tags:
-    - keystone-federation-sp
 
 - name: Ensure Group for external IDP users exists
   keystone:
@@ -85,8 +77,6 @@
     insecure: "{{ keystone_service_adminuri_insecure }}"
   when: item.group is defined
   with_items: keystone_federated_identities
-  tags:
-    - keystone-federation-sp
 
 - name: Ensure Role for external IDP users exists
   keystone:
@@ -101,8 +91,6 @@
     item.group is defined and
     item.project is defined
   with_items: keystone_federated_identities
-  tags:
-    - keystone-federation-sp
 
 - name: Ensure Group/Project/Role mapping exists
   keystone:
@@ -119,8 +107,6 @@
     item.group is defined and
     item.project is defined
   with_items: keystone_federated_identities
-  tags:
-    - keystone-federation-sp
 
 - name: Ensure mapping for external IDP attributes exists
   keystone:
@@ -134,8 +120,6 @@
     insecure: "{{ keystone_service_adminuri_insecure }}"
   when: item.protocol.mapping.name is defined
   with_items: keystone_federated_protocols
-  tags:
-    - keystone-federation-sp
 
 - name: Ensure external IDP
   keystone:
@@ -150,8 +134,6 @@
     insecure: "{{ keystone_service_adminuri_insecure }}"
   when: item.name is defined
   with_items: keystone_sp.trusted_idp_list
-  tags:
-    - keystone-federation-sp
 
 - name: Ensure federation protocol exists
   keystone:
@@ -166,5 +148,3 @@
     insecure: "{{ keystone_service_adminuri_insecure }}"
   when: item.protocol.name is defined
   with_items: keystone_federated_protocols
-  tags:
-    - keystone-federation-sp

tasks/keystone_federation_sp_setup.yml

@@ -25,9 +25,6 @@
     - { src: "shibboleth2.xml.j2", dest: "/etc/shibboleth/shibboleth2.xml" }
   notify:
     - Restart Shibd
-  tags:
-    - keystone-config
-    - keystone-federation-sp
 
 - name: Generate the Shibboleth SP key-pair
   shell: "shib-keygen -h {{ external_lb_vip_address }} -y {{ keystone_sp.cert_duration_years }}"
@@ -37,9 +34,6 @@
   notify:
     - Restart Apache
     - Restart Shibd
-  tags:
-    - keystone-config
-    - keystone-federation-sp
 
 - name: Store Shibboleth SP key-pair
   memcached:
@@ -56,9 +50,6 @@
   retries: 5
   delay: 2
   when: inventory_hostname == groups['keystone_all'][0]
-  tags:
-    - keystone-config
-    - keystone-federation-sp
 
 - name: Distribute the Shibboleth SP key-pair
   memcached:
@@ -80,9 +71,6 @@
   notify:
     - Restart Apache
     - Restart Shibd
-  tags:
-    - keystone-config
-    - keystone-federation-sp
 
 - name: Set appropriate file ownership on the Shibboleth SP key-pair
   file:
@@ -96,6 +84,3 @@
   notify:
     - Restart Apache
     - Restart Shibd
-  tags:
-    - keystone-config
-    - keystone-federation-sp

tasks/keystone_fernet_keys_autorotate.yml

@@ -25,8 +25,6 @@
     owner: "{{ keystone_system_user_name }}"
     group: "{{ keystone_system_group_name }}"
     mode: "0755"
-  tags:
-    - keystone-fernet-auto-rotate
 
 # This creates the auto rotation job on the first keystone host.
 - name: Create auto rotation job
@@ -38,8 +36,6 @@
     cron_file: keystone-fernet-rotate
   when: >
     inventory_hostname == groups['keystone_all'][0]
-  tags:
-    - keystone-fernet-auto-rotate
 
 # This makes sure that no auto rotation jobs are on any other hosts.
 - name: Remove extra auto rotation job
@@ -49,5 +45,3 @@
     state: "absent"
   when: >
     inventory_hostname != groups['keystone_all'][0]
-  tags:
-    - keystone-fernet-auto-rotate

tasks/keystone_fernet_keys_create.yml

@@ -17,8 +17,6 @@
   stat:
     path: "{{ keystone_fernet_tokens_key_repository }}/0"
   register: _fernet_keys
-  tags:
-    - keystone-fernet
 
 - name: Create fernet keys for Keystone
   command: >
@@ -28,10 +26,6 @@
   become: yes
   become_user: "{{ keystone_system_user_name }}"
   when: not _fernet_keys.stat.exists
-  tags:
-    - keystone-setup
-    - keystone-fernet
-    - keystone-command-bin
 
 - name: Rotate fernet keys for Keystone
   command: >
@@ -41,6 +35,3 @@
   become: yes
   become_user: "{{ keystone_system_user_name }}"
   when: _fernet_keys.stat.exists
-  tags:
-    - keystone-fernet
-    - keystone-command-bin

tasks/keystone_fernet_keys_distribute.yml

@@ -23,5 +23,3 @@
   become: yes
   become_user: "{{ keystone_system_user_name }}"
   with_items: groups['keystone_all'][1:]
-  tags:
-    - keystone-fernet-distribute

tasks/keystone_idp_metadata.yml

@@ -20,7 +20,4 @@
   become_user: "{{ keystone_system_user_name }}"
   when: keystone_idp is defined
   notify:
-    - Restart Apache
-  tags:
-    - keystone-config
-    - keystone-idp
+    - Restart Apache

tasks/keystone_idp_self_signed_create.yml

@@ -33,9 +33,6 @@
   when: >
     inventory_hostname == groups['keystone_all'][0]
   notify: Restart Apache
-  tags:
-    - keystone-config
-    - keystone-idp
 
 - name: Set appropriate file ownership on the IdP self-signed cert
   file:

tasks/keystone_idp_self_signed_distribute.yml

@@ -30,8 +30,6 @@
   retries: 5
   delay: 2
   notify: Restart Apache
-  tags:
-    - keystone-idp
 
 - name: Set appropriate file ownership on the IdP self-signed cert
   file:

tasks/keystone_idp_self_signed_store.yml

@@ -27,5 +27,3 @@
   until: memcache_keys|success
   retries: 5
   delay: 2
-  tags:
-    - keystone-idp

tasks/keystone_idp_sp_setup.yml

@@ -28,5 +28,3 @@
   until: add_service_providers|success
   retries: 5
   delay: 10
-  tags:
-    - keystone-idp

tasks/keystone_install.yml

@@ -16,8 +16,6 @@
 - include: keystone_install_apt.yml
   when:
     - ansible_pkg_mgr == 'apt'
-  tags:
-    - install-apt
 
 - name: Create developer mode constraint file
   copy:
@@ -28,9 +26,6 @@
       {% endfor %}
   when:
     - keystone_developer_mode | bool
-  tags:
-    - keystone-install
-    - keystone-pip-packages
 
 - name: Clone requirements git repository
   git:
@@ -41,27 +36,18 @@
     version: "{{ keystone_requirements_git_install_branch }}"
   when:
     - keystone_developer_mode | bool
-  tags:
-    - keystone-install
-    - keystone-pip-packages
 
 - name: Add constraints to pip_install_options fact for developer mode
   set_fact:
     pip_install_options_fact: "{{ pip_install_options|default('') }} --constraint /opt/developer-pip-constraints.txt --constraint /opt/requirements/upper-constraints.txt"
   when:
     - keystone_developer_mode | bool
-  tags:
-    - keystone-install
-    - keystone-pip-packages
 
 - name: Set pip_install_options_fact when not in developer mode
   set_fact:
     pip_install_options_fact: "{{ pip_install_options|default('') }}"
   when:
     - not keystone_developer_mode | bool
-  tags:
-    - keystone-install
-    - keystone-pip-packages
 
 - name: Install requires pip packages
   pip:
@@ -73,9 +59,6 @@
   retries: 5
   delay: 2
   with_items: keystone_requires_pip_packages
-  tags:
-    - keystone-install
-    - keystone-pip-packages
 
 - name: Get local venv checksum
   stat:
@@ -85,9 +68,6 @@
     - not keystone_developer_mode | bool
     - keystone_venv_enabled | bool
   register: local_venv_stat
-  tags:
-    - keystone-install
-    - keystone-pip-packages
 
 - name: Get remote venv checksum
   uri:
@@ -97,9 +77,6 @@
     - not keystone_developer_mode | bool
     - keystone_venv_enabled | bool
   register: remote_venv_checksum
-  tags:
-    - keystone-install
-    - keystone-pip-packages
 
 # TODO: When project moves to ansible 2 we can pass this a sha256sum which will:
 #       a) allow us to remove force: yes
@@ -118,17 +95,11 @@
     - keystone_venv_enabled | bool
     - (local_venv_stat.stat.exists == False or
         {{ local_venv_stat.stat.checksum is defined and local_venv_stat.stat.checksum != remote_venv_checksum.content | trim }})
-  tags:
-    - keystone-install
-    - keystone-pip-packages
 
 - name: Set keystone get_venv fact
   set_fact:
     keystone_get_venv: "{{ get_venv }}"
   when: keystone_venv_enabled | bool
-  tags:
-    - keystone-install
-    - keystone-pip-packages
 
 - name: Remove existing venv
   file:
@@ -137,9 +108,6 @@
   when:
     - keystone_venv_enabled | bool
     - keystone_get_venv | changed
-  tags:
-    - keystone-install
-    - keystone-pip-packages
 
 - name: Create keystone venv dir
   file:
@@ -149,9 +117,6 @@
     - not keystone_developer_mode | bool
     - keystone_venv_enabled | bool
     - keystone_get_venv | changed
-  tags:
-    - keystone-install
-    - keystone-pip-packages
 
 - name: Unarchive pre-built venv
   unarchive:
@@ -164,9 +129,6 @@
     - keystone_get_venv | changed
   notify:
     - Restart Apache
-  tags:
-    - keystone-install
-    - keystone-pip-packages
 
 - name: Update virtualenv path
   command: >
@@ -175,9 +137,6 @@
     - not keystone_developer_mode | bool
     - keystone_venv_enabled | bool
     - keystone_get_venv | success
-  tags:
-    - keystone-install
-    - keystone-pip-packages
 
 - name: Install pip packages (venv)
   pip:
@@ -196,9 +155,6 @@
     - keystone_get_venv | failed or keystone_developer_mode | bool
   notify:
     - Restart Apache
-  tags:
-    - keystone-install
-    - keystone-pip-packages
 
 - name: Install pip packages (no venv)
   pip:
@@ -215,6 +171,3 @@
     - not keystone_venv_enabled | bool
   notify:
     - Restart Apache
-  tags:
-    - keystone-install
-    - keystone-pip-packages

tasks/keystone_install_apt.yml

@@ -21,8 +21,6 @@
   until: apt_update|success
   retries: 5
   delay: 2
-  tags:
-    - keystone-apt-packages
 
 - name: Install apt packages
   apt:
@@ -33,9 +31,6 @@
   retries: 5
   delay: 2
   with_items: keystone_apt_packages
-  tags:
-    - keystone-install
-    - keystone-apt-packages
 
 - name: Install IdP apt packages
   apt:
@@ -47,9 +42,6 @@
   delay: 2
   with_items: keystone_idp_apt_packages
   when: keystone_idp is defined
-  tags:
-    - keystone-install
-    - keystone-apt-packages
 
 - name: Install SP apt packages
   apt:
@@ -61,9 +53,6 @@
   delay: 2
   with_items: keystone_sp_apt_packages
   when: keystone_sp is defined
-  tags:
-    - keystone-install
-    - keystone-apt-packages
 
 - name: Install developer mode apt packages
   apt:
@@ -76,6 +65,3 @@
   with_items: keystone_developer_apt_packages
   when:
     - keystone_developer_mode | bool
-  tags:
-    - keystone-install
-    - keystone-apt-packages

tasks/keystone_key_distribute.yml

@@ -18,6 +18,3 @@
     user: "{{ keystone_system_user_name }}"
     key: "{{ hostvars[item]['keystone_pubkey'] | b64decode }}"
   with_items: groups['keystone_all']
-  tags:
-    - keystone-key
-    - keystone-key-distribute

tasks/keystone_key_populate.yml

@@ -18,13 +18,7 @@
     src: "{{ keystone_system_user_home }}/.ssh/id_rsa.pub"
   register: keystone_pub
   changed_when: false
-  tags:
-    - keystone-key
-    - keystone-key-create
 
 - name: Register a fact for the keystone pub key
   set_fact:
      keystone_pubkey: "{{ keystone_pub.content }}"
-  tags:
-    - keystone-key
-    - keystone-key-create

tasks/keystone_key_setup.yml

@@ -14,11 +14,5 @@
 # limitations under the License.
 
 - include: keystone_key_populate.yml
-  tags:
-    - keystone-key
-    - keystone-key-create
 
 - include: keystone_key_distribute.yml
-  tags:
-    - keystone-key
-    - keystone-key-distribute

tasks/keystone_ldap_setup.yml

@@ -25,8 +25,6 @@
     insecure: "{{ keystone_service_adminuri_insecure }}"
   with_dict: keystone_ldap
   run_once: true
-  tags:
-    - keystone-ldap-domain-create
 
 - name: Create Keystone LDAP domain configs
   template:
@@ -38,8 +36,6 @@
   with_dict: keystone_ldap
   notify:
     - Restart Apache
-  tags:
-    - keystone-ldap-domain-config
 
 # Bug 1547542 - Older versions of the keystone role would deploy a blank
 # keystone.Default.conf and this will cause errors when adding LDAP-backed
@@ -51,5 +47,3 @@
   when: keystone_ldap.Default is not defined
   notify:
     - Restart Apache
-  tags:
-    - keystone-ldap-domain-config

tasks/keystone_messaging_setup.yml

@@ -18,9 +18,6 @@
     name: "{{ keystone_rabbitmq_vhost }}"
     state: "present"
   delegate_to: "{{ groups['rabbitmq_all'][0] }}"
-  tags:
-    - keystone-rabbitmq
-    - keystone-rabbitmq-vhost
 
 - name: Ensure rabbitmq user
   rabbitmq_user:
@@ -32,6 +29,3 @@
     write_priv: ".*"
     state: "present"
   delegate_to: "{{ groups['rabbitmq_all'][0] }}"
-  tags:
-    - keystone-rabbitmq
-    - keystone-rabbitmq-user

tasks/keystone_post_install.yml

@@ -37,8 +37,6 @@
       config_type: "json"
   notify:
     - Restart Apache
-  tags:
-    - keystone-config
 
 - name: Drop Keystone Configs
   copy:
@@ -49,8 +47,6 @@
     mode: "0644"
   notify:
     - Restart Apache
-  tags:
-    - keystone-config
 
 - name: Drop Keystone WSGI Configs
   template:
@@ -64,21 +60,15 @@
     - { src: "keystone-wsgi.py.j2", dest: "/var/www/cgi-bin/keystone/main", mode: "0755" }
   notify:
     - Restart Apache
-  tags:
-    - keystone-config
 
 - name: Get keystone command path
   command: which keystone
   register: keystone_command_path
   when:
     - not keystone_venv_enabled | bool
-  tags:
-    - keystone-command-bin
 
 - name: Set keystone command path
   set_fact:
     keystone_bin: "{{ keystone_command_path.stdout | dirname }}"
   when:
     - not keystone_venv_enabled | bool
-  tags:
-    - keystone-command-bin

tasks/keystone_pre_install.yml

@@ -18,8 +18,6 @@
     name: "{{ keystone_system_group_name }}"
     state: "present"
     system: "yes"
-  tags:
-    - keystone-group
 
 - name: create additional groups
   group:
@@ -27,8 +25,6 @@
     state: "present"
     system: "yes"
   with_items: keystone_system_additional_groups
-  tags:
-    - keystone-group
 
 - name: Remove old key file(s) if found
   file:
@@ -39,9 +35,6 @@
     - "{{ keystone_system_user_home }}/.ssh/id_rsa"
     - "{{ keystone_system_user_home }}/.ssh/id_rsa.pub"
   when: keystone_recreate_keys | bool
-  tags:
-    - keystone-key
-    - keystone-key-create
 
 - name: Create the keystone system user
   user:
@@ -54,10 +47,6 @@
     createhome: "yes"
     home: "{{ keystone_system_user_home }}"
     generate_ssh_key: "yes"
-  tags:
-    - keystone-user
-    - keystone-key
-    - keystone-key-create
 
 - name: Create keystone dir
   file:
@@ -75,8 +64,6 @@
     - { path: "{{ keystone_system_user_home }}" }
     - { path: "/var/www/cgi-bin", owner: root, group: root }
     - { path: "/var/www/cgi-bin/keystone" }
-  tags:
-    - keystone-dirs
 
 - name: Create keystone venv dir
   file:
@@ -86,8 +73,6 @@
     - { path: "/openstack/venvs" }
     - { path: "{{ keystone_venv_bin }}" }
   when: keystone_venv_enabled | bool
-  tags:
-    - keystone-dirs
 
 - name: Test for log directory or link
   shell: |
@@ -100,9 +85,6 @@
   register: log_dir
   failed_when: false
   changed_when: log_dir.rc != 0
-  tags:
-    - keystone-dirs
-    - keystone-logs
 
 - name: Create keystone log dir
   file:
@@ -112,6 +94,3 @@
     group: "{{ keystone_system_group_name }}"
     mode: "0755"
   when: log_dir.rc != 0
-  tags:
-    - keystone-dirs
-    - keystone-logs

tasks/keystone_service_setup.yml

@@ -18,9 +18,6 @@
     name: "{{ keystone_system_service_name }}"
     state: restarted
     pattern: "{{ keystone_system_service_name }}"
-  tags:
-    - keystone-db-sync
-    - keystone-setup
 
 - name: Wait for keystone admin to come up
   wait_for:
@@ -28,9 +25,6 @@
     port: "{{ keystone_admin_port }}"
     timeout: 25
     delay: 10
-  tags:
-    - keystone-db-sync
-    - keystone-setup
 
 - name: Wait for keystone service to come up
   wait_for:
@@ -38,9 +32,6 @@
     port: "{{ keystone_service_port }}"
     timeout: 25
     delay: 10
-  tags:
-    - keystone-db-sync
-    - keystone-setup
 
 - name: Bootstrap keystone admin and endpoint
   command: |
@@ -60,10 +51,6 @@
   until: add_service|success
   retries: 5
   delay: 10
-  tags:
-    - keystone-api-setup
-    - keystone-service-add
-    - keystone-setup
 
 # Create a service tenant
 - name: Ensure service tenant
@@ -80,9 +67,6 @@
   until: add_service|success
   retries: 5
   delay: 10
-  tags:
-    - keystone-api-setup
-    - keystone-setup
 
 # Add the default user role
 - name: Ensure default keystone user role
@@ -99,9 +83,6 @@
   until: add_member_role|success
   retries: 5
   delay: 10
-  tags:
-    - keystone-api-setup
-    - keystone-setup
 
 # Create a service
 - name: Ensure Keystone Service
@@ -119,10 +100,6 @@
   until: add_service|success
   retries: 5
   delay: 10
-  tags:
-    - keystone-api-setup
-    - keystone-service-add
-    - keystone-setup
 
 # Create a service user
 - name: Ensure Keystone user
@@ -140,10 +117,6 @@
   until: add_service|success
   retries: 5
   delay: 10
-  tags:
-    - keystone-api-setup
-    - keystone-service-add
-    - keystone-setup
 
 # Add a role to the user
 - name: Ensure Keystone user to Admin role
@@ -161,7 +134,3 @@
   until: add_service|success
   retries: 5
   delay: 10
-  tags:
-    - keystone-api-setup
-    - keystone-service-add
-    - keystone-setup

tasks/keystone_ssl.yml

@@ -17,9 +17,5 @@
   when: >
     keystone_ssl | bool and
     (keystone_user_ssl_cert is not defined or keystone_user_ssl_key is not defined)
-  tags:
-    - keystone-ssl
 
 - include: keystone_ssl_user_provided.yml
-  tags:
-    - keystone-ssl

tasks/keystone_ssl_key_create.yml

@@ -18,8 +18,6 @@
     dest: "{{ keystone_ssl_cert }}"
     state: "absent"
   when: keystone_ssl_self_signed_regen | bool
-  tags:
-    - keystone-ssl
 
 - name: Create self-signed Apache ssl cert
   command: >
@@ -31,9 +29,6 @@
     -extensions v3_ca
     creates={{ keystone_ssl_cert }}
   notify: Restart Apache
-  tags:
-    - keystone-configs
-    - keystone-ssl
 
 - name: Ensure keystone user owns the self-signed key and certificate
   file:
@@ -45,5 +40,3 @@
     - "{{ keystone_ssl_key }}"
     - "{{ keystone_ssl_cert }}"
   notify: Restart Apache
-  tags:
-    - keystone-ssl

tasks/keystone_ssl_key_distribute.yml

@@ -20,8 +20,6 @@
     owner: "{{ keystone_system_user_name }}"
     group: "{{ keystone_system_group_name }}"
     mode: "0640"
-  tags:
-    - keystone-ssl
 
 - name: Distribute self signed ssl cert
   copy:
@@ -30,8 +28,6 @@
     owner: "{{ keystone_system_user_name }}"
     group: "{{ keystone_system_group_name }}"
     mode: "0640"
-  tags:
-    - keystone-ssl
 
 - name: Ensure keystone user owns the self-signed key and certificate
   file:
@@ -41,5 +37,3 @@
   with_items:
     - "{{ keystone_ssl_key }}"
     - "{{ keystone_ssl_cert }}"
-  tags:
-    - keystone-ssl

tasks/keystone_ssl_key_store.yml

@@ -18,20 +18,14 @@
     src: "{{ keystone_ssl_cert }}"
   register: _keystone_ssl_cert
   changed_when: false
-  tags:
-    - keystone-ssl
 
 - name: Store ssl key
   slurp:
     src: "{{ keystone_ssl_key }}"
   register: _keystone_ssl_key
   changed_when: false
-  tags:
-    - keystone-ssl
 
 - name: Register a fact for the cert and key
   set_fact:
     keystone_ssl_cert_fact: "{{ _keystone_ssl_cert.content }}"
     keystone_ssl_key_fact: "{{ _keystone_ssl_key.content }}"
-  tags:
-    - keystone-ssl

tasks/keystone_ssl_user_provided.yml

@@ -22,9 +22,6 @@
     mode: "0644"
   when: keystone_user_ssl_cert is defined
   notify: Restart Apache
-  tags:
-    - keystone-configs
-    - keystone-ssl
 
 - name: Drop user provided ssl key
   copy:
@@ -35,9 +32,6 @@
     mode: "0640"
   when: keystone_user_ssl_key is defined
   notify: Restart Apache
-  tags:
-    - keystone-configs
-    - keystone-ssl
 
 - name: Drop user provided ssl CA cert
   copy:
@@ -48,6 +42,3 @@
     mode: "0644"
   when: keystone_user_ssl_ca_cert is defined
   notify: Restart Apache
-  tags:
-    - keystone-configs
-    - keystone-ssl

tasks/keystone_token_cleanup.yml

@@ -18,6 +18,4 @@
     name: "Clear out stale keystone tokens"
     minute: 0
     job: "{{ keystone_bin }}/keystone-manage token_flush"
-    user: "{{ keystone_system_user_name }}"
-  tags:
-    - keystone-config
+    user: "{{ keystone_system_user_name }}"

tasks/main.yml

@@ -31,38 +31,64 @@
     - always
 
 - include: keystone_pre_install.yml
+  tags:
+    - keystone-install
+
 - include: keystone_install.yml
+  tags:
+    - keystone-install
+
 - include: keystone_post_install.yml
+  tags:
+    - keystone-install
+    - keystone-config
 
 - include: keystone_key_setup.yml
   tags:
-    - keystone-key
-    - keystone-key-distribute
+    - keystone-install
 
 - include: keystone_fernet.yml
   tags:
-    - keystone-fernet
+    - keystone-install
+    - keystone-config
   when:
     - "'fernet' in keystone_token_provider"
     - keystone_service_setup | bool
 
 - include: keystone_federation_sp_setup.yml
+  tags:
+    - keystone-install
+    - keystone-config
   when:
     - keystone_sp is defined
 
 - include: keystone_db_setup.yml
+  tags:
+    - keystone-install
   when:
     - keystone_database_enabled | bool
     - inventory_hostname == groups['keystone_all'][0]
 
 - include: keystone_token_cleanup.yml
+  tags:
+    - keystone-install
   when:
     - "'sql' in keystone_token_driver"
 
 - include: keystone_ssl.yml
+  tags:
+    - keystone-install
+    - keystone-config
+
 - include: keystone_apache.yml
+  tags:
+    - keystone-install
+    - keystone-config
 
 - include: keystone_service_setup.yml
+  tags:
+    - keystone-install
+    - keystone-config
   when:
     - keystone_service_setup | bool
     - inventory_hostname == groups['keystone_all'][0]
@@ -71,10 +97,13 @@
   when:
     - keystone_service_setup | bool
   tags:
+    - keystone-install
     - keystone-config
-    - keystone-ldap
 
 - include: keystone_federation_sp_idp_setup.yml
+  tags:
+    - keystone-install
+    - keystone-config
   when:
     - keystone_service_setup | bool
     - keystone_sp is defined
@@ -84,5 +113,8 @@
   meta: flush_handlers
 
 - include: keystone_idp_setup.yml
+  tags:
+    - keystone-install
+    - keystone-config
   when:
     - keystone_idp is defined