Bifrost deploy issue on denial with venv and keystone + python-openssl system package installed

gistfile1.txt

I have a Ubuntu Xenial system where I install bifrost from master repo using venv + keystone.
With a minimal list of packages within this xenial system, everything goes fine and I can rerun the bifrost ansible deployment playbook again and again without any issue

However if I install only ONE additional package in the EXACT SAME xenial image: python-openssl I run under the following errors:

TASK [bifrost-ironic-install : Ensure service project is present] ************************************************************************************************************************************************
task path: /home/vagrant/bifrost/playbooks/roles/bifrost-ironic-install/tasks/keystone_setup.yml:42

TASK [bifrost-ironic-install : Create service user for ironic-inspector] *****************************************************************************************************************************************
task path: /home/vagrant/bifrost/playbooks/roles/bifrost-ironic-install/tasks/keystone_setup_inspector.yml:41

TASK [bifrost-keystone-install : Install pymysql package from pip]
task path: /home/vagrant/bifrost/playbooks/roles/bifrost-keystone-install/tasks/pip_install.yml:14
"msg": "\n:stderr: Traceback (most recent call last):\n  File \"/usr/bin/pip2\", line 9, in <module>\n    load_entry_point('pip==8.1.1', 'console_scripts', 'pip2')()\n  File \"/usr/lib/python2.7/dist-packages/pkg_resources/__init__.py\", line 542, in load_entry_point\n    return get_distribution(dist).load_entry_point(group, name)\n  File \"/usr/lib/python2.7/dist-packages/pkg_resources/__init__.py\", line 2569, in load_entry_point\n    return ep.load()\n  File \"/usr/lib/python2.7/dist-packages/pkg_resources/__init__.py\", line 2229, in load\n    return self.resolve()\n  File \"/usr/lib/python2.7/dist-packages/pkg_resources/__init__.py\", line 2235, in resolve\n    module = __import__(self.module_name, fromlist=['__name__'], level=0)\n  File \"/usr/lib/python2.7/dist-packages/pip/__init__.py\", line 13, in <module>\n    from pip.exceptions import InstallationError, CommandError, PipError\n  File \"/usr/lib/python2.7/dist-packages/pip/exceptions.py\", line 6, in <module>\n    from pip._vendor.six import iteritems\n  File \"/usr/lib/python2.7/dist-packages/pip/_vendor/__init__.py\", line 64, in <module>\n    vendored(\"cachecontrol\")\n  File \"/usr/lib/python2.7/dist-packages/pip/_vendor/__init__.py\", line 36, in vendored\n    __import__(modulename, globals(), locals(), level=0)\n  File \"/usr/share/python-wheels/CacheControl-0.11.5-py2.py3-none-any.whl/cachecontrol/__init__.py\", line 9, in <module>\n  File \"/usr/share/python-wheels/CacheControl-0.11.5-py2.py3-none-any.whl/cachecontrol/wrapper.py\", line 1, in <module>\n  File \"/usr/share/python-wheels/CacheControl-0.11.5-py2.py3-none-any.whl/cachecontrol/adapter.py\", line 3, in <module>\n  File \"/usr/share/python-wheels/requests-2.9.1-py2.py3-none-any.whl/requests/__init__.py\", line 53, in <module>\n  File \"/usr/share/python-wheels/urllib3-1.13.1-py2.py3-none-any.whl/urllib3/contrib/pyopenssl.py\", line 54, in <module>\n  File \"/usr/lib/python2.7/dist-packages/OpenSSL/__init__.py\", line 8, in <module>\n    from OpenSSL import rand, crypto, SSL\n  File \"/usr/lib/python2.7/dist-packages/OpenSSL/SSL.py\", line 118, in <module>\n    SSL_ST_INIT = _lib.SSL_ST_INIT\nAttributeError: 'module' object has no attribute 'SSL_ST_INIT'\n"

Even worse, if I retry to launch the deployment once error occured I get an error even earlier on at

TASK [bifrost-keystone-install : Install packages]
task path: /home/vagrant/bifrost/playbooks/roles/bifrost-keystone-install/tasks/install.yml:14

From a deeper analysis it seems to be related to the fact that shade is installed on the system even if venv is selected: see https://github.com/openstack/bifrost/blob/master/playbooks/roles/bifrost-ironic-install/tasks/install.yml#L60:L69
and therefore once shade is installed and referenced from /usr/local/lib/python2.7/dist-packages/shade/ it also uses /usr/lib/python2.7/dist-packages/OpenSSL which leads to errors like:

The full traceback is:
Traceback (most recent call last):
  File "/tmp/ansible_r5l5fz/ansible_module_os_user.py", line 150, in <module>
    import shade
  File "/usr/local/lib/python2.7/dist-packages/shade/__init__.py", line 19, in <module>
    from openstack.config import loader
  File "/usr/local/lib/python2.7/dist-packages/openstack/__init__.py", line 16, in <module>
    import openstack.config
  File "/usr/local/lib/python2.7/dist-packages/openstack/config/__init__.py", line 17, in <module>
    from openstack.config.loader import OpenStackConfig  # noqa
  File "/usr/local/lib/python2.7/dist-packages/openstack/config/loader.py", line 27, in <module>
    from keystoneauth1 import adapter
  File "/usr/local/lib/python2.7/dist-packages/keystoneauth1/adapter.py", line 16, in <module>
    from keystoneauth1 import session
  File "/usr/local/lib/python2.7/dist-packages/keystoneauth1/session.py", line 25, in <module>
    import requests
  File "/usr/local/lib/python2.7/dist-packages/requests/__init__.py", line 95, in <module>
    from urllib3.contrib import pyopenssl
  File "/usr/local/lib/python2.7/dist-packages/urllib3/contrib/pyopenssl.py", line 46, in <module>
    import OpenSSL.SSL
  File "/usr/lib/python2.7/dist-packages/OpenSSL/__init__.py", line 8, in <module>
    from OpenSSL import rand, crypto, SSL
  File "/usr/lib/python2.7/dist-packages/OpenSSL/SSL.py", line 118, in <module>
    SSL_ST_INIT = _lib.SSL_ST_INIT
AttributeError: 'module' object has no attribute 'SSL_ST_INIT'

fatal: [127.0.0.1]: FAILED! => {
    "changed": false,
    "failed": true,
    "module_stderr": "Traceback (most recent call last):\n  File \"/tmp/ansible_r5l5fz/ansible_module_os_user.py\", line 150, in <module>\n    import shade\n  File \"/usr/local/lib/python2.7/dist-packages/shade/__init__.py\", line 19, in <module>\n    from openstack.config import loader\n  File \"/usr/local/lib/python2.7/dist-packages/openstack/__init__.py\", line 16, in <module>\n    import openstack.config\n  File \"/usr/local/lib/python2.7/dist-packages/openstack/config/__init__.py\", line 17, in <module>\n    from openstack.config.loader import OpenStackConfig  # noqa\n  File \"/usr/local/lib/python2.7/dist-packages/openstack/config/loader.py\", line 27, in <module>\n    from keystoneauth1 import adapter\n  File \"/usr/local/lib/python2.7/dist-packages/keystoneauth1/adapter.py\", line 16, in <module>\n    from keystoneauth1 import session\n  File \"/usr/local/lib/python2.7/dist-packages/keystoneauth1/session.py\", line 25, in <module>\n    import requests\n  File \"/usr/local/lib/python2.7/dist-packages/requests/__init__.py\", line 95, in <module>\n    from urllib3.contrib import pyopenssl\n  File \"/usr/local/lib/python2.7/dist-packages/urllib3/contrib/pyopenssl.py\", line 46, in <module>\n    import OpenSSL.SSL\n  File \"/usr/lib/python2.7/dist-packages/OpenSSL/__init__.py\", line 8, in <module>\n    from OpenSSL import rand, crypto, SSL\n  File \"/usr/lib/python2.7/dist-packages/OpenSSL/SSL.py\", line 118, in <module>\n    SSL_ST_INIT = _lib.SSL_ST_INIT\nAttributeError: 'module' object has no attribute 'SSL_ST_INIT'\n",
    "module_stdout": "",
    "msg": "MODULE FAILURE",
    "rc": 0
}

I have started a fix for this very particular case at https://review.openstack.org/591646