Enforce upper-constraints when building ramdisksliberty-eol1.0.5stable/liberty

Currently, building ramdisks installs ironic-python-agent without any
upper-constraints. This causes the package to be installed with newer,
untested dependencies.

This commits introduces a tool to generate a local upper-constraints
file based on predefined strategies (below). Additionally, the fallback
to the openstack/requirements uses the URL defined in tox.ini instead of
redefining it. This prevents having to keep track of two separate
variables when releasing.

upper-constraints lookup strategies (in order):

  * UPPER_CONSTRAINTS_FILE points to a local file
  * UPPER_CONSTRAINTS_FILE points to a URL
  * /opt/stack/new/requirements/upper-constraints.txt
  * upper-constraints.txt from openstack/requirements git repository

Partial-bug: #1616554
Change-Id: Ib5c0c57cafdb6ffd7456e61f3b1bb5fa57520e5a
(cherry picked from commit a0ca6ce157b8a84f282d8abbdd27c75f48d991ff)

5 files changed, 99 insertions, 4 deletions

diff --git a/.gitignore b/.gitignore
index d96bf002..2014a5ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,3 +21,6 @@ doc/build
 
 # release notes build
 releasenotes/build
+
+# upper-constraints handling for image builds
+upper-constraints.txt
diff --git a/Dockerfile b/Dockerfile
index f6aa451b..337f2ea5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -28,11 +28,10 @@ RUN apt-mark manual python-minimal
 # Install requirements separately, because pip understands a git+https url
 # while setuptools doesn't
 RUN pip install --upgrade pip
-# TODO(jroll) use upper-constraints here
-RUN pip install -r /tmp/ironic-python-agent/requirements.txt
+RUN pip install -c /tmp/ironic-python-agent/upper-constraints.txt -r /tmp/ironic-python-agent/requirements.txt
 
 # This will succeed because all the dependencies were installed previously
-RUN pip install /tmp/ironic-python-agent
+RUN pip install -c /tmp/ironic-python-agent/upper-constraints.txt /tmp/ironic-python-agent
 
 # Remove no longer needed packages
 RUN apt-get -y purge gcc-4.6 gcc python2.7-dev git && \
diff --git a/imagebuild/common/extract_upper_constraints_from_tox_ini.sh b/imagebuild/common/extract_upper_constraints_from_tox_ini.sh
new file mode 100755
index 00000000..86bd9973
--- /dev/null
+++ b/imagebuild/common/extract_upper_constraints_from_tox_ini.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# NOTE(mmitchell): This extracts the URL defined as the default value for
+#                  UPPER_CONSTRAINTS_FILE in tox.ini. This is used by image
+#                  builders to avoid duplicating the default value in multiple
+#                  scripts. This is specially done to leverage the release
+#                  tools that automatically update the tox.ini when projects
+#                  are released.
+sed -n 's/^.*{env:UPPER_CONSTRAINTS_FILE\:\([^}]*\)}.*$/\1/p' $1 | head -n1
+
diff --git a/imagebuild/common/generate_upper_constraints.sh b/imagebuild/common/generate_upper_constraints.sh
new file mode 100755
index 00000000..cd61b784
--- /dev/null
+++ b/imagebuild/common/generate_upper_constraints.sh
@@ -0,0 +1,79 @@
+#!/bin/bash -eu
+
+SCRIPT_NAME=$(basename $0)
+COMMON_ROOT=$(dirname $0)
+DESTINATION="$1"
+TOX_INI_UPPER_CONSTRAINT_URL="$(${COMMON_ROOT}/extract_upper_constraints_from_tox_ini.sh ${COMMON_ROOT}/../../tox.ini)"
+
+copy() {
+  local src=$1
+  local destination=$2
+
+  if test -z "${src}"; then
+    return 1
+  fi
+
+  if test -e "${src}"; then
+    log "File '${src}' exists. Using as upper-constraints."
+    cp "${src}" "${destination}"
+  else
+    log "File '${src}' not found. Skipping local file strategy."
+    return 1
+  fi
+  return 0
+}
+
+download() {
+  local url=$1
+  local destination=$2
+
+  if test -z "${url}"; then
+     return 1
+  else
+    log "Downloading from '${url}'"
+    curl ${url} -o "${destination}"
+  fi
+  return 0
+}
+
+log() {
+  echo "${SCRIPT_NAME}: ${@}"
+}
+
+fail() {
+  log ${@}
+  exit 1
+}
+
+upper_constraints_is_not_null() {
+  test "${UPPER_CONSTRAINTS_FILE:-""}" != ""
+}
+
+copy_uc() {
+  copy "${UPPER_CONSTRAINTS_FILE:-""}" "${DESTINATION}"
+}
+
+download_uc() {
+  download "${UPPER_CONSTRAINTS_FILE:-""}" "${DESTINATION}"
+}
+
+copy_new_requirements_uc() {
+  copy "/opt/stack/new/requirements/upper-constraints.txt" "${DESTINATION}"
+}
+
+download_from_tox_ini_url() {
+  log "tox.ini indicates '${TOX_INI_UPPER_CONSTRAINT_URL}' as fallback."
+  download "${TOX_INI_UPPER_CONSTRAINT_URL}" "${DESTINATION}"
+}
+
+log "Generating local constraints file..."
+
+if upper_constraints_is_not_null; then
+  log "UPPER_CONSTRAINTS_FILE is defined as '${UPPER_CONSTRAINTS_FILE:-""}'"
+  copy_uc || download_uc || fail "Failed to copy or download file indicated in UPPER_CONSTRAINTS_FILE."
+else
+  log "UPPER_CONSTRAINTS_FILE is not defined. Using fallback strategies."
+
+  copy_new_requirements_uc || \
+  download_from_tox_ini_url || fail "Failed to download upper-constraints.txt from '${TOX_INI_UPPER_CONSTRAINT_URL}'."
+fi
diff --git a/imagebuild/coreos/docker_build.bash b/imagebuild/coreos/docker_build.bash
index f3c74769..fbc2ade3 100755
--- a/imagebuild/coreos/docker_build.bash
+++ b/imagebuild/coreos/docker_build.bash
@@ -7,6 +7,7 @@
 set -e
 
 OUTPUT_FILE="oem/container.tar.gz"
+IPA_ROOT=$(readlink -f $(dirname $0)/../../)
 
 # If there's already a container.tar.gz, don't overwrite it -- instead, bail
 if [[ -e "${OUTPUT_FILE}" ]]; then
@@ -15,7 +16,11 @@ if [[ -e "${OUTPUT_FILE}" ]]; then
 fi
 
 # Build the docker image
-cd ../../
+# Everything from ${IPA_ROOT} will be available under /tmp/ironic-python-agent in Docker
+cd ${IPA_ROOT}
+
+imagebuild/common/generate_upper_constraints.sh ${IPA_ROOT}/upper-constraints.txt
+
 docker build -t oemdocker .
 cd -