Apply global-pins as constraints to ensure complete pinning

The current pinning method for pip/setuptools/wheel works for the
initial setup of a host or python venv. However, when a python
package which has one of these in its requirements is installed
onto the host or into the venv and the '--upgrade' option is given
to pip, the package will be upgraded to the latest version available
within the given constraints.

As OpenStack's requirements management process does not cater for
the pip, setuptools or wheel packages we need to ensure that all
python install tasks prior to the repo being built use our global
pins as a constraint in addition to the OpenStack uppser constraints.

As pip's --constraints option can only take a file as an argument
we have to copy the global pins file to the target which will use
it. This file can be removed from the host once the repo is built.

Combined backport of:
- https://review.openstack.org/424283
- https://review.openstack.org/424540

Closes-Bug: #1658773
Closes-Bug: #1658948
Change-Id: Iccbb2e4a126a1cc7a4c94ab41b7ce8ef54d89990
(cherry picked from commit 253ea10)

playbooks/common-tasks/set-upper-constraints.yml

@@ -25,8 +25,21 @@
   register: upper_constraints_check
   failed_when: false
 
+- name: Remove global requirement pins file from host
+  file:
+    path: "/opt/global-requirement-pins.txt"
+    state: absent
+  when: (upper_constraints_check.status | default(503)) == 200
+
+- name: Copy global requirement pins file to host
+  copy:
+    src: "../global-requirement-pins.txt"
+    dest: "/opt/global-requirement-pins.txt"
+  when: (upper_constraints_check.status | default(503)) != 200
+
 - name: Set pip install upper constraints
   set_fact:
     pip_install_upper_constraints: >-
-      http://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt?id={{ requirements_git_install_branch | regex_replace(' #.*$','') }}
+      /opt/global-requirement-pins.txt
+      --constraint http://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt?id={{ requirements_git_install_branch | regex_replace(' #.*$','') }}
   when: (upper_constraints_check.status | default(503)) != 200

releasenotes/notes/issue-ansible-bootstrap-pins-637af623a1d5aef4.yaml

@@ -0,0 +1,6 @@
+---
+issues:
+  - The bootstrap-ansible script may fail with an incompatible requirement
+    when installing OpenStack-Ansible 14.0.6 and before. See
+    https://bugs.launchpad.net/openstack-ansible/+bug/1658948 for more
+    details.

scripts/bootstrap-ansible.sh

@@ -110,7 +110,7 @@ PIP_COMMAND="/opt/ansible-runtime/bin/pip"
 ${PIP_COMMAND} install ${PIP_OPTS} ${PIP_INSTALL_OPTIONS} || ${PIP_COMMAND} install ${PIP_OPTS} --isolated ${PIP_INSTALL_OPTIONS}
 
 # Set the constraints now that we know we're using the right version of pip
-PIP_OPTS+=" --constraint ${UPPER_CONSTRAINTS_FILE}"
+PIP_OPTS+=" --constraint global-requirement-pins.txt --constraint ${UPPER_CONSTRAINTS_FILE}"
 
 # Install the required packages for ansible
 $PIP_COMMAND install $PIP_OPTS -r requirements.txt ${ANSIBLE_PACKAGE} || $PIP_COMMAND install --isolated $PIP_OPTS -r requirements.txt ${ANSIBLE_PACKAGE}

tox.ini

@@ -8,8 +8,9 @@ envlist = docs,linters,releasenotes
 usedevelop = True
 basepython = python2.7
 install_command =
-    pip install -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt?h=stable/newton} {opts} {packages}
+    pip install -c{toxinidir}/global-requirement-pins.txt -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt?h=stable/newton} {opts} {packages}
 deps =
+    -r{toxinidir}/global-requirement-pins.txt
     -r{toxinidir}/test-requirements.txt
     sphinxmark>=0.1.14
 passenv =