Merge "Revert "Revert "Blacklist support for ExtraConfig"""

11 files changed, 192 insertions, 7 deletions

diff --git a/extraconfig/pre_deploy/rhel-registration/rhel-registration.yaml b/extraconfig/pre_deploy/rhel-registration/rhel-registration.yaml
index 96632bc2..fb0d1699 100644
--- a/extraconfig/pre_deploy/rhel-registration/rhel-registration.yaml
+++ b/extraconfig/pre_deploy/rhel-registration/rhel-registration.yaml
@@ -59,6 +59,19 @@ parameters:
     description: |
       When enabled, the system will perform a yum update after performing the
       RHEL Registration process.
+  deployment_actions:
+    default: ['CREATE', 'UPDATE']
+    type: comma_delimited_list
+    description: >
+      List of stack actions that will trigger any deployments in this
+      templates. The actions will be an empty list of the server is in the
+      toplevel DeploymentServerBlacklist parameter's value.
+
+conditions:
+  deployment_actions_empty:
+    equals:
+      - {get_param: deployment_actions}
+      - []
 
 resources:
 
@@ -136,7 +149,11 @@ resources:
       name: RHELUnregistrationDeployment
       server:  {get_param: server}
       config: {get_resource: RHELUnregistration}
-      actions: ['DELETE'] # Only do this on DELETE
+      actions:
+        if:
+          - deployment_actions_empty
+          - []
+          - ['DELETE'] # Only do this on DELETE
       input_values:
         REG_METHOD: {get_param: rhel_reg_method}
 
@@ -169,7 +186,11 @@ resources:
       name: UpdateDeploymentAfterRHELRegistration
       config: {get_resource: YumUpdateConfigurationAfterRHELRegistration}
       server:  {get_param: server}
-      actions: ['CREATE'] # Only do this on CREATE
+      actions:
+        if:
+          - deployment_actions_empty
+          - []
+          - ['CREATE'] # Only do this on CREATE
 
 outputs:
   deploy_stdout:
diff --git a/extraconfig/pre_network/config_then_reboot.yaml b/extraconfig/pre_network/config_then_reboot.yaml
index 48ba5263..79cb7cbc 100644
--- a/extraconfig/pre_network/config_then_reboot.yaml
+++ b/extraconfig/pre_network/config_then_reboot.yaml
@@ -7,6 +7,19 @@ description: >
 parameters:
   server:
     type: string
+  deployment_actions:
+    default: ['CREATE', 'UPDATE']
+    type: comma_delimited_list
+    description: >
+      List of stack actions that will trigger any deployments in this
+      templates. The actions will be an empty list of the server is in the
+      toplevel DeploymentServerBlacklist parameter's value.
+
+conditions:
+  deployment_actions_empty:
+    equals:
+      - {get_param: deployment_actions}
+      - []
 
 resources:
 
@@ -24,6 +37,11 @@ resources:
       name: SomeDeployment
       server:  {get_param: server}
       config: {get_resource: SomeConfig}
+      actions:
+        if:
+          - deployment_actions_empty
+          - []
+          - ['CREATE'] # Only do this on CREATE
       actions: ['CREATE'] # Only do this on CREATE
 
   RebootConfig:
@@ -44,5 +62,9 @@ resources:
       name: RebootDeployment
       server:  {get_param: server}
       config: {get_resource: RebootConfig}
-      actions: ['CREATE'] # Only do this on CREATE
+      actions:
+        if:
+          - deployment_actions_empty
+          - []
+          - ['CREATE'] # Only do this on CREATE
       signal_transport: NO_SIGNAL
diff --git a/extraconfig/pre_network/host_config_and_reboot.role.j2.yaml b/extraconfig/pre_network/host_config_and_reboot.role.j2.yaml
index 41d8f4f6..fe52ef7e 100644
--- a/extraconfig/pre_network/host_config_and_reboot.role.j2.yaml
+++ b/extraconfig/pre_network/host_config_and_reboot.role.j2.yaml
@@ -19,6 +19,13 @@ parameters:
   {{role}}HostCpusList:
     type: string
     default: ""
+  deployment_actions:
+    default: ['CREATE', 'UPDATE']
+    type: comma_delimited_list
+    description: >
+      List of stack actions that will trigger any deployments in this
+      templates. The actions will be an empty list of the server is in the
+      toplevel DeploymentServerBlacklist parameter's value.
 
 parameter_group:
   - label: deprecated
@@ -38,6 +45,10 @@ conditions:
           equals:
           - get_param: {{role}}TunedProfileName
           - ""
+  deployment_actions_empty:
+    equals:
+      - {get_param: deployment_actions}
+      - []
 
 resources:
 
@@ -62,7 +73,11 @@ resources:
       name: HostParametersDeployment
       server:  {get_param: server}
       config: {get_resource: HostParametersConfig}
-      actions: ['CREATE'] # Only do this on CREATE
+      actions:
+        if:
+          - deployment_actions_empty
+          - []
+          - ['CREATE'] # Only do this on CREATE
       input_values:
         _KERNEL_ARGS_: {get_param: {{role}}KernelArgs}
         _TUNED_PROFILE_NAME_: {get_param: {{role}}TunedProfileName}
@@ -88,7 +103,11 @@ resources:
       name: RebootDeployment
       server:  {get_param: server}
       config: {get_resource: RebootConfig}
-      actions: ['CREATE'] # Only do this on CREATE
+      actions:
+        if:
+          - deployment_actions_empty
+          - []
+          - ['CREATE'] # Only do this on CREATE
       signal_transport: NO_SIGNAL
 
 outputs:
diff --git a/extraconfig/pre_network/host_config_and_reboot.yaml b/extraconfig/pre_network/host_config_and_reboot.yaml
index 009a0879..6c46133a 100644
--- a/extraconfig/pre_network/host_config_and_reboot.yaml
+++ b/extraconfig/pre_network/host_config_and_reboot.yaml
@@ -95,6 +95,13 @@ parameters:
     default: "vfio-pci"
     description: DPDK Driver type
     type: string
+  deployment_actions:
+    default: ['CREATE', 'UPDATE']
+    type: comma_delimited_list
+    description: >
+      List of stack actions that will trigger any deployments in this
+      templates. The actions will be an empty list of the server is in the
+      toplevel DeploymentServerBlacklist parameter's value.
 
 conditions:
   is_host_config_required: {not: {equals: [{get_param: [RoleParameters, KernelArgs]}, ""]}}
@@ -117,6 +124,10 @@ conditions:
   socket_mem_empty: {equals: [{get_param: OvsDpdkSocketMemory}, '']}
   driver_not_set: {equals: [{get_param: OvsDpdkDriverType}, 'vfio-pci']}
   isol_cpus_empty: {equals: [{get_param: IsolCpusList}, '0']}
+  deployment_actions_empty:
+    equals:
+      - {get_param: deployment_actions}
+      - []
 
 resources:
   RoleParametersValue:
@@ -162,7 +173,11 @@ resources:
       name: HostParametersDeployment
       server:  {get_param: server}
       config: {get_resource: HostParametersConfig}
-      actions: ['CREATE'] # Only do this on CREATE
+      actions:
+        if:
+          - deployment_actions_empty
+          - []
+          - ['CREATE'] # Only do this on CREATE
       input_values:
         _KERNEL_ARGS_: {get_param: [RoleParameters, KernelArgs]}
         _TUNED_PROFILE_NAME_: {get_param: [RoleParameters, TunedProfileName]}
@@ -224,7 +239,11 @@ resources:
       name: RebootDeployment
       server:  {get_param: server}
       config: {get_resource: RebootConfig}
-      actions: ['CREATE'] # Only do this on CREATE
+      actions:
+        if:
+          - deployment_actions_empty
+          - []
+          - ['CREATE'] # Only do this on CREATE
       signal_transport: NO_SIGNAL
 
 outputs:
diff --git a/extraconfig/tasks/ssh/host_public_key.yaml b/extraconfig/tasks/ssh/host_public_key.yaml
index e4ba0cc4..02fdbf1c 100644
--- a/extraconfig/tasks/ssh/host_public_key.yaml
+++ b/extraconfig/tasks/ssh/host_public_key.yaml
@@ -7,6 +7,13 @@ parameters:
   server:
     description: ID of the node to apply this config to
     type: string
+  deployment_actions:
+    default: ['CREATE', 'UPDATE']
+    type: comma_delimited_list
+    description: >
+      List of stack actions that will trigger any deployments in this
+      templates. The actions will be an empty list of the server is in the
+      toplevel DeploymentServerBlacklist parameter's value.
 
 resources:
   SshHostPubKeyConfig:
@@ -28,6 +35,7 @@ resources:
     properties:
       config: {get_resource: SshHostPubKeyConfig}
       server: {get_param: server}
+      actions: {get_param: deployment_actions}
 
 
 outputs:
diff --git a/puppet/blockstorage-role.yaml b/puppet/blockstorage-role.yaml
index 311a1927..7d58d1da 100644
--- a/puppet/blockstorage-role.yaml
+++ b/puppet/blockstorage-role.yaml
@@ -409,6 +409,7 @@ resources:
       server: {get_resource: BlockStorage}
       RoleParameters: {get_param: RoleParameters}
       ServiceNames: {get_param: ServiceNames}
+      deployment_actions: {get_attr: [DeploymentActions, value]}
 
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
@@ -517,6 +518,9 @@ resources:
   NodeExtraConfig:
     depends_on: NodeTLSCAData
     type: OS::TripleO::NodeExtraConfig
+    # We have to use conditions here so that we don't break backwards
+    # compatibility with templates everywhere
+    condition: server_not_blacklisted
     properties:
         server: {get_resource: BlockStorage}
 
@@ -539,11 +543,21 @@ resources:
           - ['CREATE', 'UPDATE']
           - []
 
+  DeploymentActions:
+    type: OS::Heat::Value
+    properties:
+      value:
+        if:
+          - server_not_blacklisted
+          - ['CREATE', 'UPDATE']
+          - []
+
   SshHostPubKey:
     type: OS::TripleO::Ssh::HostPubKey
     depends_on: BlockStorageDeployment
     properties:
         server: {get_resource: BlockStorage}
+        deployment_actions: {get_attr: [DeploymentActions, value]}
 
 outputs:
   ip_address:
diff --git a/puppet/cephstorage-role.yaml b/puppet/cephstorage-role.yaml
index 96946e4d..48e5b97a 100644
--- a/puppet/cephstorage-role.yaml
+++ b/puppet/cephstorage-role.yaml
@@ -415,6 +415,7 @@ resources:
       server: {get_resource: CephStorage}
       RoleParameters: {get_param: RoleParameters}
       ServiceNames: {get_param: ServiceNames}
+      deployment_actions: {get_attr: [DeploymentActions, value]}
 
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
@@ -521,6 +522,9 @@ resources:
   CephStorageExtraConfigPre:
     depends_on: CephStorageDeployment
     type: OS::TripleO::CephStorageExtraConfigPre
+    # We have to use conditions here so that we don't break backwards
+    # compatibility with templates everywhere
+    condition: server_not_blacklisted
     properties:
         server: {get_resource: CephStorage}
 
@@ -529,6 +533,9 @@ resources:
   NodeExtraConfig:
     depends_on: [CephStorageExtraConfigPre, NodeTLSCAData]
     type: OS::TripleO::NodeExtraConfig
+    # We have to use conditions here so that we don't break backwards
+    # compatibility with templates everywhere
+    condition: server_not_blacklisted
     properties:
         server: {get_resource: CephStorage}
 
@@ -550,11 +557,21 @@ resources:
           - ['CREATE', 'UPDATE']
           - []
 
+  DeploymentActions:
+    type: OS::Heat::Value
+    properties:
+      value:
+        if:
+          - server_not_blacklisted
+          - ['CREATE', 'UPDATE']
+          - []
+
   SshHostPubKey:
     type: OS::TripleO::Ssh::HostPubKey
     depends_on: CephStorageDeployment
     properties:
         server: {get_resource: CephStorage}
+        deployment_actions: {get_attr: [DeploymentActions, value]}
 
 outputs:
   ip_address:
diff --git a/puppet/compute-role.yaml b/puppet/compute-role.yaml
index ace8df28..3ad6f745 100644
--- a/puppet/compute-role.yaml
+++ b/puppet/compute-role.yaml
@@ -418,6 +418,7 @@ resources:
       server: {get_resource: NovaCompute}
       RoleParameters: {get_param: RoleParameters}
       ServiceNames: {get_param: ServiceNames}
+      deployment_actions: {get_attr: [DeploymentActions, value]}
 
   NetworkConfig:
     type: OS::TripleO::Compute::Net::SoftwareConfig
@@ -544,6 +545,9 @@ resources:
   ComputeExtraConfigPre:
     depends_on: NovaComputeDeployment
     type: OS::TripleO::ComputeExtraConfigPre
+    # We have to use conditions here so that we don't break backwards
+    # compatibility with templates everywhere
+    condition: server_not_blacklisted
     properties:
         server: {get_resource: NovaCompute}
 
@@ -552,6 +556,9 @@ resources:
   NodeExtraConfig:
     depends_on: [ComputeExtraConfigPre, NodeTLSCAData]
     type: OS::TripleO::NodeExtraConfig
+    # We have to use conditions here so that we don't break backwards
+    # compatibility with templates everywhere
+    condition: server_not_blacklisted
     properties:
         server: {get_resource: NovaCompute}
 
@@ -574,11 +581,21 @@ resources:
         update_identifier:
           get_param: UpdateIdentifier
 
+  DeploymentActions:
+    type: OS::Heat::Value
+    properties:
+      value:
+        if:
+          - server_not_blacklisted
+          - ['CREATE', 'UPDATE']
+          - []
+
   SshHostPubKey:
     type: OS::TripleO::Ssh::HostPubKey
     depends_on: NovaComputeDeployment
     properties:
         server: {get_resource: NovaCompute}
+        deployment_actions: {get_attr: [DeploymentActions, value]}
 
 outputs:
   ip_address:
diff --git a/puppet/controller-role.yaml b/puppet/controller-role.yaml
index c9c30af5..cdc2ec68 100644
--- a/puppet/controller-role.yaml
+++ b/puppet/controller-role.yaml
@@ -441,6 +441,7 @@ resources:
       server: {get_resource: Controller}
       RoleParameters: {get_param: RoleParameters}
       ServiceNames: {get_param: ServiceNames}
+      deployment_actions: {get_attr: [DeploymentActions, value]}
 
   NetworkConfig:
     type: OS::TripleO::Controller::Net::SoftwareConfig
@@ -583,6 +584,9 @@ resources:
   ControllerExtraConfigPre:
     depends_on: ControllerDeployment
     type: OS::TripleO::ControllerExtraConfigPre
+    # We have to use conditions here so that we don't break backwards
+    # compatibility with templates everywhere
+    condition: server_not_blacklisted
     properties:
         server: {get_resource: Controller}
 
@@ -591,6 +595,9 @@ resources:
   NodeExtraConfig:
     depends_on: [ControllerExtraConfigPre, NodeTLSData]
     type: OS::TripleO::NodeExtraConfig
+    # We have to use conditions here so that we don't break backwards
+    # compatibility with templates everywhere
+    condition: server_not_blacklisted
     properties:
         server: {get_resource: Controller}
 
@@ -613,11 +620,21 @@ resources:
         update_identifier:
           get_param: UpdateIdentifier
 
+  DeploymentActions:
+    type: OS::Heat::Value
+    properties:
+      value:
+        if:
+          - server_not_blacklisted
+          - ['CREATE', 'UPDATE']
+          - []
+
   SshHostPubKey:
     type: OS::TripleO::Ssh::HostPubKey
     depends_on: ControllerDeployment
     properties:
         server: {get_resource: Controller}
+        deployment_actions: {get_attr: [DeploymentActions, value]}
 
 outputs:
   ip_address:
diff --git a/puppet/objectstorage-role.yaml b/puppet/objectstorage-role.yaml
index 6b9618de..a03a9da5 100644
--- a/puppet/objectstorage-role.yaml
+++ b/puppet/objectstorage-role.yaml
@@ -409,6 +409,7 @@ resources:
       server: {get_resource: SwiftStorage}
       RoleParameters: {get_param: RoleParameters}
       ServiceNames: {get_param: ServiceNames}
+      deployment_actions: {get_attr: [DeploymentActions, value]}
 
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
@@ -517,6 +518,9 @@ resources:
   NodeExtraConfig:
     depends_on: NodeTLSCAData
     type: OS::TripleO::NodeExtraConfig
+    # We have to use conditions here so that we don't break backwards
+    # compatibility with templates everywhere
+    condition: server_not_blacklisted
     properties:
         server: {get_resource: SwiftStorage}
 
@@ -538,11 +542,21 @@ resources:
           - ['CREATE', 'UPDATE']
           - []
 
+  DeploymentActions:
+    type: OS::Heat::Value
+    properties:
+      value:
+        if:
+          - server_not_blacklisted
+          - ['CREATE', 'UPDATE']
+          - []
+
   SshHostPubKey:
     type: OS::TripleO::Ssh::HostPubKey
     depends_on: SwiftStorageHieraDeploy
     properties:
         server: {get_resource: SwiftStorage}
+        deployment_actions: {get_attr: [DeploymentActions, value]}
 
 outputs:
   ip_address:
diff --git a/puppet/role.role.j2.yaml b/puppet/role.role.j2.yaml
index 1c9af901..039bd6ba 100644
--- a/puppet/role.role.j2.yaml
+++ b/puppet/role.role.j2.yaml
@@ -386,6 +386,7 @@ resources:
       server: {get_resource: {{role.name}}}
       RoleParameters: {get_param: RoleParameters}
       ServiceNames: {get_param: ServiceNames}
+      deployment_actions: {get_attr: [DeploymentActions, value]}
 
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
@@ -498,6 +499,9 @@ resources:
   {{role.name}}ExtraConfigPre:
     depends_on: {{role.name}}Deployment
     type: OS::TripleO::{{role.name}}ExtraConfigPre
+    # We have to use conditions here so that we don't break backwards
+    # compatibility with templates everywhere
+    condition: server_not_blacklisted
     properties:
         server: {get_resource: {{role.name}}}
 
@@ -506,6 +510,9 @@ resources:
   NodeExtraConfig:
     depends_on: [{{role.name}}ExtraConfigPre, NodeTLSCAData]
     type: OS::TripleO::NodeExtraConfig
+    # We have to use conditions here so that we don't break backwards
+    # compatibility with templates everywhere
+    condition: server_not_blacklisted
     properties:
         server: {get_resource: {{role.name}}}
 
@@ -528,11 +535,21 @@ resources:
           - ['CREATE', 'UPDATE']
           - []
 
+  DeploymentActions:
+    type: OS::Heat::Value
+    properties:
+      value:
+        if:
+          - server_not_blacklisted
+          - ['CREATE', 'UPDATE']
+          - []
+
   SshHostPubKey:
     type: OS::TripleO::Ssh::HostPubKey
     depends_on: {{role.name}}Deployment
     properties:
         server: {get_resource: {{role.name}}}
+        deployment_actions: {get_attr: [DeploymentActions, value]}
 
 outputs:
   ip_address: