Fix ip6tables support in xenapi bug 934603

Change-Id: Id7c4b0c4f8710652249b5c4fcb82abd5cccde6dd
Revert "Check for selinux before setting up selinux."

The existing code used trycmd(readlink) precisely because
/etc/selinux might not exist. The presented traceback in
the bug is only debug info.

Also the change will not work with libguestfs for example,
where the nova user can't access mount points mounted by root.

After discussion on IRC it was decided to reduce
debugging output in a subsequent commit.

Reverts: 9bea239f
Change-Id: Id07eae5b330332f36ad7caa786593e486aa36469
Set default keystone auth_token signing_dir loc.

Updates the nova api-paste.ini file with a custom signing_dir
for Nova. This works around potential multi-service permission issues which
can occur when multiple OpenStack services share a common signing directory.

Change-Id: I99df63838fd41a4cade99b54da9511978b0d1a86
Tidy up nova.image.glance

* Add comment explaining relevance of _is_image_available
* Drop superfluous log statements
* Drop GlanceImageService.delete_all as it has never been implemented
* Drop the 'features' kwarg for GlanceImageService.update
* Code simplification

Change-Id: Ie538dd93dec729fb060bbcddfbddcba6cf303e52
Add check exit codes for vlans

Add check_exit_code to check the ip address
creation in ensure_vlan.

Ignores error code '2' and '0' and '254'
from iproute2, which means the address
has been added or removed.

A further audit of return codes will come later.

LP: #1011640

Change-Id: Ie95b106446c9f136fa079d95df7a14fe50046696
Signed-off-by: Chuck Short <chuck.short@canonical.com>
Send a full instance in unrescue_instance.

Change the unrescue_instance method of the compute
rpc API to take a full instance over rpc instead of just
the instance UUID.  This cuts down on database access needed
by nova-compute.

Part of blueprint no-db-messaging.

Change-Id: I9a693b347ce583aa350f4c10531b53e0f9813577
Send a full instance in change_instance_metadata.

Change the change_instance_metadata method of the compute
rpc API to take a full instance over rpc instead of just
the instance UUID.  This cuts down on database access needed
by nova-compute.

These methods were moved in rpcapi.py and test_rpcapi.py but only because
the rest of the file was in alphabetical order.  The move puts it in the
right place to maintain that order.

Part of blueprint no-db-messaging.

Change-Id: I7dd2fb7480010893f66c753b3d31a4556009efe0
Update targets information when creating target.

tgt-admin needs to use --execute --update to tell
tgtd to re-read its configuration files when target
is created.

(LP: #1031509)

Change-Id: I71fe4d90a8cc9bcf7a4817aefd6de52e216102a4
Signed-off-by: Chuck Short <chuck.short@canonical.com>
Merge "Send a full instance in unrescue_instance."
Merge "Send a full instance in change_instance_metadata."
Prevent instance_info_cache from being altered post instance

It turns out people have found ways to use the info cache everywhere.
The problem is when these ways require information about deleted
instances the info_cache may not be accurate.

This patch prevents the info_cache from being altered after it is
marked as deleted and marks an instance's info_cache as deleted
towards the beginning of the destroy process to ensure it doesn't
get blown away by a cache refresh somewhere along the way.

Change-Id: I0d5c2f1fc7e5f8f6c1154958986bb775ced07443
Merge "Update targets information when creating target."
Merge "Tidy up nova.image.glance"
XenAPI: Fix race-condition with cached images.

The core problem is that XenServer's `VDI.copy` call drops the
destination file directly into the SR. This means that half-completed
files are visible with no way to distinguish these from fully-copied
files.

We had some code that attempted to mitigate this issue by checking
physical_utilisation against an expected value. The problem with this
code is that it didn't account for VDI chaining where the
physical_utilisation would not necessarily match the parent.

The net effect of this was that 'cloned' VDIs would never be found
because their physical_utilisation was far below what was expected.

The work around is to create our own `_safe_copy_vdi` which is isolated
and atomic. Long term, `VDI.copy` should be fixed so that half-completed
files are never stored in the SR.

Change-Id: I6eb3cb5259f9ee1c7394e58f76105a8b39bfc720
Merge "Set default keystone auth_token signing_dir loc."
Merge "Fix ip6tables support in xenapi bug 934603"
Setting root passwd no longer fails silently.

Fixes LP 1022961

Previously an attempt to set the root password would fail silently if
for example the driver did not support this action.

To avoid the user being misled that the password change had succeeded,
we now report any failure by changing the MEP for set_admin_password
RPC from cast to call.

Change-Id: I1fd7b925e9226d30892f3a7cc4ddb938ff678a55
Clarify TooManyInstances exception message.

Fixes LP 1031737.

Previously the message indicated the number of instances requested
and an incorrect indication of the headroom, in the case where ram
or cores was the resource gone over-quota (as opposed to the number
of raw instances).

Change-Id: I9f7f3203f0e644ba533940a87e496bfd09da0460
Use instance_get instead of instance_by.

Updates the network manager to use db.instance_get instead of
db.instance_by (which doesn't exist). This change seems to have
slipped in in the recent vifs UUID conversion code.

Fixes LP Bug #1031756.

Change-Id: Ie487a2f845a722a5e7923e26a550d74f553e8afc
Deprecate root_helper in favor of rootwrap_config

Mark the root_helper option deprecated and introduce usage of
the rootwrap_config option instead. The root_helper option will
still fully be supported in Folsom, but will be removed in Grizzly.

Transition notes: you should replace:
root_helper=sudo nova-rootwrap /etc/nova/rootwrap.conf

by:
rootwrap_config=/etc/nova/rootwrap.conf

Implements bp deprecate-root-helper

Change-Id: I8dfc94e9b91f7ffc82d393b345f09409da347e78