3 files changed, 23 insertions, 1 deletions
diff --git a/extraconfig/tasks/pacemaker_common_functions.sh b/extraconfig/tasks/pacemaker_common_functions.sh
index d1dd5d1d..367f50d7 100755
--- a/extraconfig/tasks/pacemaker_common_functions.sh
+++ b/extraconfig/tasks/pacemaker_common_functions.sh
@@ -371,3 +371,15 @@ function fixup_wrong_ipv6_vip {
         fi
     )
 }
+
+# https://bugs.launchpad.net/tripleo/+bug/1704131 guard against yum update
+# waiting for an existing process until the heat stack time out
+function check_for_yum_lock {
+    if [[ -f /var/run/yum.pid ]] ; then
+        ERR="ERROR existing yum.pid detected - can't continue! Please ensure
+there is no other package update process for the duration of the minor update
+worfklow. Exiting."
+        echo $ERR
+        exit 1
+   fi
+}
diff --git a/extraconfig/tasks/ssh/host_public_key.yaml b/extraconfig/tasks/ssh/host_public_key.yaml
index e4ba0cc4..02fdbf1c 100644
--- a/extraconfig/tasks/ssh/host_public_key.yaml
+++ b/extraconfig/tasks/ssh/host_public_key.yaml
@@ -7,6 +7,13 @@ parameters:
   server:
     description: ID of the node to apply this config to
     type: string
+  deployment_actions:
+    default: ['CREATE', 'UPDATE']
+    type: comma_delimited_list
+    description: >
+      List of stack actions that will trigger any deployments in this
+      templates. The actions will be an empty list of the server is in the
+      toplevel DeploymentServerBlacklist parameter's value.
 
 resources:
   SshHostPubKeyConfig:
@@ -28,6 +35,7 @@ resources:
     properties:
       config: {get_resource: SshHostPubKeyConfig}
       server: {get_param: server}
+      actions: {get_param: deployment_actions}
 
 
 outputs:
diff --git a/extraconfig/tasks/yum_update.sh b/extraconfig/tasks/yum_update.sh
index 5f5daf23..a2a04e8e 100755
--- a/extraconfig/tasks/yum_update.sh
+++ b/extraconfig/tasks/yum_update.sh
@@ -96,6 +96,7 @@ if [[ "$pacemaker_status" == "active" ]] ; then
     fi
 else
     echo "Upgrading openstack-puppet-modules and its dependencies"
+    check_for_yum_lock
     yum -q -y update openstack-puppet-modules
     yum deplist openstack-puppet-modules | awk '/dependency/{print $2}' | xargs yum -q -y update
     echo "Upgrading other packages is handled by config management tooling"
@@ -105,8 +106,9 @@ fi
 
 command=${command:-update}
 full_command="yum -q -y $command $command_arguments"
-echo "Running: $full_command"
 
+echo "Running: $full_command"
+check_for_yum_lock
 result=$($full_command)
 return_code=$?
 echo "$result"