Update Calico Felix agent to 2.3

Update calico-felix to the latest stable release, which requires an
upgrade to the deployment methods used since the 2.x calico-felix
was rewritten to a Go based agent (the old 1.x releases were Python
based).

Backport of https://review.openstack.org/#/c/478618/ due to
incompatibilities I discovered in the Calico 1.x releases with Ocata,
requiring an update to the new Go based Felix agent for use of Calico
on Ocata and later OpenStack releases.

Also includes a partial backport of
I67f1377b6172558341fcf95eff73775b10c870ca, which contains updated
test inventories for calico and dragonflow to match the Neutron
test container config that was recently updated in
I672ceb0848415c8f2653ebc8f7556db77f7f001c.

Includes backport of I42a68601b3e3c6035080650caaf30ce9bc2bf712 also,
which is required to maintain vars consistency.

Change-Id: I9c3cb1a11319f692113badf4d49bc8903effcbd7

defaults/main.yml

@@ -36,23 +36,25 @@ neutron_vpnaas_git_install_branch: stable/ocata
 neutron_dynamic_routing_git_repo: https://git.openstack.org/openstack/neutron-dynamic-routing
 neutron_dynamic_routing_git_install_branch: stable/ocata
 
-calico_git_repo: https://github.com/projectcalico/felix
-calico_git_install_branch: stable/ocata
-
 networking_calico_git_repo: https://git.openstack.org/openstack/networking-calico
-networking_calico_git_install_branch: stable/ocata
+networking_calico_git_install_branch: master
 
 dragonflow_git_repo: https://git.openstack.org/openstack/dragonflow
 dragonflow_git_install_branch: stable/ocata
 
+# Calico Felix agent upstream settings
+calico_felix_url: "https://github.com/projectcalico/felix/releases/download/{{ calico_felix_version }}/calico-felix"
+calico_felix_version: 2.3.0
+calico_felix_sha256: 6cc538d6d93d2b5e732841769f427ce61a4e7d9a6eedf4ca8d33c4df42cf6419
+calico_felix_validate_certs: yes
+
 neutron_developer_mode: false
 neutron_developer_constraints:
   - "git+{{ neutron_git_repo }}@{{ neutron_git_install_branch }}#egg=neutron"
   - "git+{{ neutron_fwaas_git_repo }}@{{ neutron_fwaas_git_install_branch }}#egg=neutron-fwaas"
   - "git+{{ neutron_lbaas_git_repo }}@{{ neutron_lbaas_git_install_branch }}#egg=neutron-lbaas"
   - "git+{{ neutron_vpnaas_git_repo }}@{{ neutron_vpnaas_git_install_branch }}#egg=neutron-vpnaas"
   - "git+{{ neutron_dynamic_routing_git_repo }}@{{ neutron_dynamic_routing_git_install_branch }}#egg=neutron-dynamic-routing"
-  - "git+{{ calico_git_repo }}@{{ calico_git_install_branch }}#egg=felix"
   - "git+{{ networking_calico_git_repo }}@{{ networking_calico_git_install_branch }}#egg=networking-calico"
   - "git+{{ dragonflow_git_repo }}@{{ dragonflow_git_install_branch }}#egg=dragonflow"
 
@@ -352,6 +354,7 @@ neutron_services:
    group: neutron_calico_dhcp_agent
    system_user: root
    system_group: root
+   program_override: "{{ calico_felix_bin }}"
    service_name: calico-felix
    service_en: "{{ neutron_plugin_type == 'ml2.calico' }}"
    service_conf_path: /etc/calico
@@ -673,7 +676,6 @@ neutron_optional_bgp_pip_packages:
   - neutron_dynamic_routing
 
 neutron_optional_calico_pip_packages:
-  - felix
   - networking-calico
   - python-etcd
 

tasks/calico_config.yml

@@ -36,6 +36,23 @@
     - calico-install
     - calico-pip-packages
 
+- name: Install Calico Felix agent
+  get_url:
+    url: "{{ calico_felix_url }}"
+    dest: "{{ calico_felix_bin }}"
+    sha256sum: "{{ calico_felix_sha256 }}"
+    validate_certs: "{{ calico_felix_validate_certs }}"
+    mode: '0755'
+  register: install_packages
+  until: install_packages|success
+  retries: 5
+  delay: 2
+  when:
+    - "neutron_services['calico-felix']['group'] in group_names"
+  notify: Restart neutron services
+  tags:
+    - calico-install
+
 - name: Ensure calico config directory exists
   file:
     path: "/etc/calico"
@@ -46,4 +63,4 @@
   when:
     - neutron_services['calico-felix']['group'] in group_names
   tags:
-    - calico-felix-config
+    - calico-config

tests/calico_inventory

@@ -1,14 +1,20 @@
 [all]
 localhost
 infra1
-openstack1
+server1
+server2
+agents1
+agents2
 
 [physical_host]
 localhost
 
 [all_containers]
 infra1
-openstack1
+server1
+server2
+agents1
+agents2
 
 [rabbitmq_all]
 infra1
@@ -32,13 +38,15 @@ memcached_all
 etcd_all
 
 [keystone_all]
-openstack1
+infra1
 
 [neutron_calico_dhcp_agent]
-openstack1
+agents1
+agents2
 
 [neutron_server]
-openstack1
+server1
+server2
 
 [neutron_agent]
 [neutron_dhcp_agent]
@@ -62,4 +70,4 @@ neutron_server
 neutron_calico_dhcp_agent
 
 [utility_all]
-openstack1
+infra1

tests/dragonflow_inventory

@@ -1,14 +1,20 @@
 [all]
 localhost
 infra1
-openstack1
+server1
+server2
+agents1
+agents2
 
 [physical_host]
 localhost
 
 [all_containers]
 infra1
-openstack1
+server1
+server2
+agents1
+agents2
 
 [rabbitmq_all]
 infra1
@@ -32,19 +38,22 @@ memcached_all
 etcd_all
 
 [keystone_all]
-openstack1
+infra1
 
 [neutron_server]
-openstack1
+server1
+server2
 
 [dragonflow_pubsub_agent]
-openstack1
+server1
+server2
 
 [dragonflow_controller_agent]
 localhost
 
 [dragonflow_l3_agent]
-openstack1
+agents1
+agents2
 
 [neutron_agent]
 [neutron_dhcp_agent]
@@ -70,4 +79,4 @@ dragonflow_pubsub_agent
 dragonflow_l3_agent
 
 [utility_all]
-openstack1
+infra1

tests/neutron-overrides-calico.yml

@@ -23,6 +23,11 @@ tempest_plugins:
 tempest_test_whitelist:
   - neutron.tests.tempest.api.test_networks*
 
+tempest_private_net_provider_type: "local"
+tempest_private_net_seg_id: ''
+tempest_public_net_provider_type: "local"
+tempest_public_net_physical_type: ''
+
 neutron_plugin_type: ml2.calico
 neutron_provider_networks:
   network_types: ''

tests/test-calico-functional.yml

@@ -14,7 +14,7 @@
 # limitations under the License.
 
 - name: Test calico
-  hosts: neutron_all
+  hosts: neutron_calico_dhcp_agent
   user: root
   gather_facts: true
   tasks:
@@ -24,14 +24,17 @@
         - calico-felix
         - calico-dhcp-age
     - name: Ensure that the Calico Felix agent is alive
-      shell: |
-        . /root/openrc
-        neutron agent-list | grep calico-felix
+      command: openstack --os-cloud default network agent list -f json
       register: calico_felix_agent
-      until: calico_felix_agent.stdout.find(':-)') != -1
-      when:
-        - groups['neutron_calico_dhcp_agent'] | length > 0
+      until: |-
+        ansible_nodename in (calico_felix_agent.stdout
+                            | from_json
+                            | selectattr('Binary', 'equalto', 'calico-felix')
+                            | map(attribute='Host') | list)
       retries: 5
       delay: 10
+      with_items: "{{ ansible_play_hosts }}"
+      delegate_to: "{{ groups['utility_all'][0] }}"
+      run_once: yes
   vars_files:
     - common/test-vars.yml

vars/main.yml

@@ -36,6 +36,9 @@ neutron_package_list: |-
   {% endif %}
   {{ packages }}
 
+# Set the Calico Felix agent executable destination path
+calico_felix_bin: /usr/local/bin/calico-felix
+
 #
 # Compile a list of the services on a host based on whether
 # the host is in the host group and the service is enabled.
@@ -52,4 +55,3 @@ filtered_neutron_services: |-
   {%   endif %}
   {% endfor %}
   {{ services | sort(attribute='start_order') }}
-