Fix ip6tables support in xenapi bug 934603

Change-Id: Id7c4b0c4f8710652249b5c4fcb82abd5cccde6dd
Instance cleanups from detach_volumes.

We can just use members of the instance dictionary without turning
them into local variables, as we don't need to populate instance_uuid
manually, as that is done by the @checks_instance_lock decorator.

Change-Id: I2046d5688c2f5122624dc338680b7ddd850ed330
Revert "Check for selinux before setting up selinux."

The existing code used trycmd(readlink) precisely because
/etc/selinux might not exist. The presented traceback in
the bug is only debug info.

Also the change will not work with libguestfs for example,
where the nova user can't access mount points mounted by root.

After discussion on IRC it was decided to reduce
debugging output in a subsequent commit.

Reverts: 9bea239f
Change-Id: Id07eae5b330332f36ad7caa786593e486aa36469
Set default keystone auth_token signing_dir loc.

Updates the nova api-paste.ini file with a custom signing_dir
for Nova. This works around potential multi-service permission issues which
can occur when multiple OpenStack services share a common signing directory.

Change-Id: I99df63838fd41a4cade99b54da9511978b0d1a86
Tidy up nova.image.glance

* Add comment explaining relevance of _is_image_available
* Drop superfluous log statements
* Drop GlanceImageService.delete_all as it has never been implemented
* Drop the 'features' kwarg for GlanceImageService.update
* Code simplification

Change-Id: Ie538dd93dec729fb060bbcddfbddcba6cf303e52
Merge "Instance cleanups from detach_volumes."
Compute: Error out instance on rebuild and resize.

If a rebuild or a resize fails, then we should error out the instance.
This code takes an idiom we already use in the compute manager and adds
it to the rebuild and resize code.

Change-Id: Ia90c038eb4677e109d58e9b79bb8a05490689c9f
Add check exit codes for vlans

Add check_exit_code to check the ip address
creation in ensure_vlan.

Ignores error code '2' and '0' and '254'
from iproute2, which means the address
has been added or removed.

A further audit of return codes will come later.

LP: #1011640

Change-Id: Ie95b106446c9f136fa079d95df7a14fe50046696
Signed-off-by: Chuck Short <chuck.short@canonical.com>
Send a full instance in unrescue_instance.

Change the unrescue_instance method of the compute
rpc API to take a full instance over rpc instead of just
the instance UUID.  This cuts down on database access needed
by nova-compute.

Part of blueprint no-db-messaging.

Change-Id: I9a693b347ce583aa350f4c10531b53e0f9813577
Send a full instance in change_instance_metadata.

Change the change_instance_metadata method of the compute
rpc API to take a full instance over rpc instead of just
the instance UUID.  This cuts down on database access needed
by nova-compute.

These methods were moved in rpcapi.py and test_rpcapi.py but only because
the rest of the file was in alphabetical order.  The move puts it in the
right place to maintain that order.

Part of blueprint no-db-messaging.

Change-Id: I7dd2fb7480010893f66c753b3d31a4556009efe0
Avoid recursion from @refresh_cache

Previously the decorator current called out indirectly to
nova.api.network.api.API.get_instance_nw_info(), which is also
decoratored by @refresh_cache.

Change-Id: I8b71e2f6c85d007cde0da32890168c922102a7d8
Update targets information when creating target.

tgt-admin needs to use --execute --update to tell
tgtd to re-read its configuration files when target
is created.

(LP: #1031509)

Change-Id: I71fe4d90a8cc9bcf7a4817aefd6de52e216102a4
Signed-off-by: Chuck Short <chuck.short@canonical.com>
Merge "Send a full instance in unrescue_instance."
Merge "Send a full instance in change_instance_metadata."
Prevent instance_info_cache from being altered post instance

It turns out people have found ways to use the info cache everywhere.
The problem is when these ways require information about deleted
instances the info_cache may not be accurate.

This patch prevents the info_cache from being altered after it is
marked as deleted and marks an instance's info_cache as deleted
towards the beginning of the destroy process to ensure it doesn't
get blown away by a cache refresh somewhere along the way.

Change-Id: I0d5c2f1fc7e5f8f6c1154958986bb775ced07443
Merge "Update targets information when creating target."
Merge "Tidy up nova.image.glance"
XenAPI: Fix race-condition with cached images.

The core problem is that XenServer's `VDI.copy` call drops the
destination file directly into the SR. This means that half-completed
files are visible with no way to distinguish these from fully-copied
files.

We had some code that attempted to mitigate this issue by checking
physical_utilisation against an expected value. The problem with this
code is that it didn't account for VDI chaining where the
physical_utilisation would not necessarily match the parent.

The net effect of this was that 'cloned' VDIs would never be found
because their physical_utilisation was far below what was expected.

The work around is to create our own `_safe_copy_vdi` which is isolated
and atomic. Long term, `VDI.copy` should be fixed so that half-completed
files are never stored in the SR.

Change-Id: I6eb3cb5259f9ee1c7394e58f76105a8b39bfc720
Merge "Set default keystone auth_token signing_dir loc."
Merge "Fix ip6tables support in xenapi bug 934603"