Re-deploy the Horizon venv if it mismatches the repo

We currently have two issues with venvs:

- if you update your venv on the repo server, it is not possible for
  that updated venv to land on the service's container as the get_url
  task always skips if the file exists (even if the file is different)
- if you have an updated venv on the repo server and forcefully delete
  the cached venv tarball on the service's container, the new tarball
  will get unarchived over top of the existing venv

This commit does the following:

- updates repo_build/tasks/repo_venv_build.yml to create checksum files
  of each venv tarball
- gets the checksum of the /var/cache tarball and downloads checksum
  file from repo server
- updates "Attempt venv download" to only download the venv if the
  cache doesn't exist or if the local and remote checksums differ
- adds a "force: true" to "Attempt venv download" task so that the venv
  tarball will get re-downloaded when the when condition is true (this
  is necessary otherwise the download will get skipped since the
  destination already exists)
- adds a new task "Remove existing venv" so we can first remove the
  venv before we unarchive the potentially new venv from the repo
  server
- updates "Create horizon venv dir" and "Unarchive pre-built venv"
  tasks to only proceed if "horizon_get_venv | changed", which
  prevents these tasks from running when they the venv tarball hasn't
  changed

NOTE: The reason why we compare local and remote checksum is to avoid
      unnecessarily downloading the venv when the checksums are in fact
      the same.  On small deploys this is more or less a non-issue but
      if a deploy w/ thousands of compute nodes re-runs playbooks we
      want to limit the venv downloads when it's unnecessary.

Assuming this logic is correct, this review can be updated so that all
similar roles can be updated accordingly.

Change-Id: I41c3576b69d73611a38024f0bc95eeac47787e25

playbooks/repo-build.yml

@@ -37,6 +37,7 @@
         - repo-create-venv-archive
         - repo-venv-compress-archive
         - repo-build-venvs
+        - repo-create-venv-checksum
   roles:
     - role: "repo_build"
       repo_build_release_tag: "{{ openstack_release }}"

playbooks/roles/os_horizon/defaults/main.yml

@@ -150,6 +150,7 @@ horizon_requires_pip_packages:
   - virtualenv
   - virtualenv-tools
   - python-keystoneclient # Keystoneclient needed to OSA keystone lib
+  - httplib2
 
 horizon_pip_packages:
   - django-appconf

playbooks/roles/os_horizon/tasks/horizon_pre_install.yml

@@ -71,13 +71,42 @@
   tags:
     - horizon-pip-packages
 
+- name: Get local venv checksum
+  stat:
+    path: "/var/cache/{{ horizon_venv_download_url | basename }}"
+    get_md5: False
+  when: horizon_venv_enabled | bool
+  register: local_venv_stat
+  tags:
+    - horizon-install
+    - horizon-pip-packages
+
+- name: Get remote venv checksum
+  uri:
+    url: "{{ horizon_venv_download_url | replace('tgz', 'checksum') }}"
+    return_content: True
+  when: horizon_venv_enabled | bool
+  register: remote_venv_checksum
+  tags:
+    - horizon-install
+    - horizon-pip-packages
+
+# TODO: When project moves to ansible 2 we can pass this a sha256sum which will:
+#       a) allow us to remove force: yes
+#       b) allow the module to calculate the checksum of dest file which would
+#          result in file being downloaded only if provided and dest sha256sum
+#          checksums differ
 - name: Attempt venv download
   get_url:
     url: "{{ horizon_venv_download_url }}"
     dest: "/var/cache/{{ horizon_venv_download_url | basename }}"
+    force: yes
   ignore_errors: true
   register: get_venv
-  when: horizon_venv_enabled | bool
+  when:
+    - horizon_venv_enabled | bool
+    - (local_venv_stat.stat.exists == False or
+        {{ local_venv_stat.stat.checksum is defined and local_venv_stat.stat.checksum != remote_venv_checksum.content | trim }})
   tags:
     - horizon-install
     - horizon-pip-packages
@@ -90,13 +119,24 @@
     - horizon-install
     - horizon-pip-packages
 
+- name: Remove existing venv
+  file:
+    path: "{{ horizon_venv_bin | dirname }}"
+    state: absent
+  when:
+    - horizon_venv_enabled | bool
+    - horizon_get_venv | changed
+  tags:
+    - horizon-install
+    - horizon-pip-packages
+
 - name: Create horizon venv dir
   file:
     path: "{{ horizon_venv_bin | dirname }}"
     state: directory
   when:
     - horizon_venv_enabled | bool
-    - horizon_get_venv | success
+    - horizon_get_venv | changed
   tags:
     - horizon-install
     - horizon-pip-packages
@@ -108,7 +148,7 @@
     copy: "no"
   when:
     - horizon_venv_enabled | bool
-    - horizon_get_venv | success
+    - horizon_get_venv | changed
   tags:
     - horizon-install
     - horizon-pip-packages

playbooks/roles/repo_build/tasks/repo_venv_build.yml

@@ -79,3 +79,16 @@
     - repo-venv-compress-archive
     - repo-create-venv-archive
     - repo-create-venv
+
+- name: Create venv archive checksum
+  shell: >
+    sha1sum "{{ item.key | replace('os_', '') }}-{{ repo_build_release_tag }}.tgz" | awk '{print $1}' > "{{ item.key | replace('os_', '') }}-{{ repo_build_release_tag }}.checksum"
+  args:
+    chdir: "{{ repo_build_venv_dir }}/{{ repo_build_release_tag }}/{{ ansible_distribution | lower }}"
+    creates: "{{ repo_build_venv_dir }}/{{ repo_build_release_tag }}/{{ ansible_distribution | lower }}/{{ item.key | replace('os_', '') }}-{{ repo_build_release_tag }}.checksum"
+  with_dict: local_packages.results.0.item.role_packages
+  when:
+    - '"os_" in item.key'
+  tags:
+    - repo-create-venv-checksum
+    - repo-create-venv