Fix ip6tables support in xenapi bug 934603

Change-Id: Id7c4b0c4f8710652249b5c4fcb82abd5cccde6dd
Revert "Check for selinux before setting up selinux."

The existing code used trycmd(readlink) precisely because
/etc/selinux might not exist. The presented traceback in
the bug is only debug info.

Also the change will not work with libguestfs for example,
where the nova user can't access mount points mounted by root.

After discussion on IRC it was decided to reduce
debugging output in a subsequent commit.

Reverts: 9bea239f
Change-Id: Id07eae5b330332f36ad7caa786593e486aa36469
Set default keystone auth_token signing_dir loc.

Updates the nova api-paste.ini file with a custom signing_dir
for Nova. This works around potential multi-service permission issues which
can occur when multiple OpenStack services share a common signing directory.

Change-Id: I99df63838fd41a4cade99b54da9511978b0d1a86
Add check exit codes for vlans

Add check_exit_code to check the ip address
creation in ensure_vlan.

Ignores error code '2' and '0' and '254'
from iproute2, which means the address
has been added or removed.

A further audit of return codes will come later.

LP: #1011640

Change-Id: Ie95b106446c9f136fa079d95df7a14fe50046696
Signed-off-by: Chuck Short <chuck.short@canonical.com>
Prevent instance_info_cache from being altered post instance

It turns out people have found ways to use the info cache everywhere.
The problem is when these ways require information about deleted
instances the info_cache may not be accurate.

This patch prevents the info_cache from being altered after it is
marked as deleted and marks an instance's info_cache as deleted
towards the beginning of the destroy process to ensure it doesn't
get blown away by a cache refresh somewhere along the way.

Change-Id: I0d5c2f1fc7e5f8f6c1154958986bb775ced07443
XenAPI: Fix race-condition with cached images.

The core problem is that XenServer's `VDI.copy` call drops the
destination file directly into the SR. This means that half-completed
files are visible with no way to distinguish these from fully-copied
files.

We had some code that attempted to mitigate this issue by checking
physical_utilisation against an expected value. The problem with this
code is that it didn't account for VDI chaining where the
physical_utilisation would not necessarily match the parent.

The net effect of this was that 'cloned' VDIs would never be found
because their physical_utilisation was far below what was expected.

The work around is to create our own `_safe_copy_vdi` which is isolated
and atomic. Long term, `VDI.copy` should be fixed so that half-completed
files are never stored in the SR.

Change-Id: I6eb3cb5259f9ee1c7394e58f76105a8b39bfc720
Merge "Set default keystone auth_token signing_dir loc."
Merge "Fix ip6tables support in xenapi bug 934603"
Setting root passwd no longer fails silently.

Fixes LP 1022961

Previously an attempt to set the root password would fail silently if
for example the driver did not support this action.

To avoid the user being misled that the password change had succeeded,
we now report any failure by changing the MEP for set_admin_password
RPC from cast to call.

Change-Id: I1fd7b925e9226d30892f3a7cc4ddb938ff678a55
Use instance_get instead of instance_by.

Updates the network manager to use db.instance_get instead of
db.instance_by (which doesn't exist). This change seems to have
slipped in in the recent vifs UUID conversion code.

Fixes LP Bug #1031756.

Change-Id: Ie487a2f845a722a5e7923e26a550d74f553e8afc
Fix failed iscsi tgt delete errors with new tgtadm

Now that the tgtadm patches are working, one problem was detected
The delete target operation would fail, and as a result lvremove
would fail due to an open connection.

There were a number of issue using the config file method, but
the most reliable way is to just use the iqn since we're going
to perform an os.unlink on the config file anyway.

devstack volumes.sh tests now pass and the detach/delete
calls are succesful.

Adjust test_iscsi for modifications to delete

Change-Id: Ic34ca2194b8d75fb84a06dfba6793106eb8055fe
Fix get_diagnostics RPC arg ordering.

Updates the ordering of the compute managers get_diagnostics
call so it works correctly with the current wrap_instance_fault and
checks_instance_lock decorators. To work correctly 'instance' needs
to be the first argument after the context.

Fixes LP Bug #1031788.

Change-Id: Ia7105eb272cd2932fc4f25b297ecab9e5ab8dbe2
Merge "Setting root passwd no longer fails silently."
maint: don't require write access when reading files

Change 'r+' to 'r' for open() when just reading.
The '+' is uneeded and distracting.

Change-Id: I8c611ab6d63e165f86e588992011f73f69565249
Merge "Add check exit codes for vlans"
Merge "XenAPI: Fix race-condition with cached images."
Merge "Fix get_diagnostics RPC arg ordering."
Merge "maint: don't require write access when reading files"
Merge "Prevent instance_info_cache from being altered post instance"
Send a full instance in terminate_instance.

Change the terminate_instance method of the compute
rpc API to take a full instance over rpc instead of just
the instance UUID.  This cuts down on database access needed
by nova-compute.

This is the final change for instances in rpcapi.py.  \o/
Unfortunately, I discovered that the scheduler isn't properly using
rpc API versioning when talking to compute nodes, so some of the methods
used by the scheduler still need some love.

Part of blueprint no-db-messaging.

Change-Id: Ic62450346ea90b9a6d64e282e992a21a4dd6ab64