Copperfist: lor deploy

[scimerman]

Copperfist LOR deployed ✔️
Added few files for copperfist and renamed some others. ✔️
Networking changed (updated for both BB and CF) from /24 to /23 to include the ldap server network ✔️

The important note is that the roles/admin_users/tasks/main.yml is doing now SE-labeling, and it works only if there is a package policycoreutils-python pre-installed. If missing, the problem appears:

TASK [admin_users : Put SELinux in permissive mode] ****************************************************************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ImportError: u'selinux' is present in the Mitogen importer blacklist, therefore this context will not attempt to request it from the master, as the request will always be refused.
fatal: [nb-vcompute04]: FAILED! => changed=false 
  msg: Failed to import the required Python library (libselinux-python) on nb-vcompute04's Python /usr/bin/python2.7. Please read the module documentation and install it in the appropriate location. If the required library is installed, but Ansible is using the wrong Python interpreter, please consult the documentation on ansible_python_interpreter

if I manually install package, then problem is resolved. I added yum installation in the admin role, BUT this introduce new problem:

1. we first do yum install
2. then configure SE labeling
3. and at the end we configure repositories
4. (much later in the playbook) we update system

this will work in fresh cluster deployment. But will be problematic if some node is later redeployed

• as it will use at step 1 default public repository and install package with latest upstream version,
• then it will configure our local repositories, and will fail at system update due to the: policycoreutils-python (and few of it's dependencies) installed duplicates

Possible solutions:

• move SE labeling somewhere to later configuration,
• check if policycoreutils-python is available and run command only then,
• potentially change the roles order: first repository configuration and then admin configuration
  need to discuss.