libvirt: use tap for non-blockdevice images on Xen

This patch reverts 35c4962c0b97bae5b8751d316d5822fe22c1ab6a: 'use
file instead of tap for non-blockdevice images on Xen', which breaks
qcow2 disk working on Xen. If the method pick_disk_driver_name()
returns 'file' for qcow2 format, we would get the following disk XML
snippet:

    <disk type="file" device="disk">
      <driver name="file" type="qcow2" cache="none"/>
      <source file="/data/instances/instance-00000081/disk"/>
      <target bus="xen" dev="hda"/>
    </disk>

which produces configuration in the xen tools like:

    "file:/data/instances/instance-00000081/disk,hda,w"

Guest would not boot successfully, as Xen doesn't think of disk format
as qcow2. Instead, 'tap' works with both raw and qcow2 disk.

For LP#1084618, I think it is related with libvirt verion. In my
deployment(libvirt-1.0.1), 'tap' dirver could produce correct
configuration for both raw and qcow2 disk format.

Change-Id: I636b2fed366474e2ae8c3b52403e3085724b24f0
Add rootwrap filters for password injection with localfs

Allow to 'sudo cat' to read passwd and shadow.

bug 1098077

Change-Id: Ic734bd33223df879b5e1f144bb4c85702eb88dfa
Fix floating ips with external gateway

If dnsmasq is configured to use an external gateway, then floating
ips on other interfaces do not work properly. This is because
outgoing traffic is no longer snatted to the floating ip.

This patch fixes it by adding an ebtables rule to force traffic
from ips that have a floating ip associated to route instead
of bridge.

Fixes bug 1096985

Change-Id: I8e4904660d42fe51c44b66686bed9f5d622693bd
Add version constraint for cinder

Cinder client usage requires the "retries" parameter introduced in
cinderclient-1.0.1. This should be a constraint in pip-requires.

Change-Id: I36e8a363c9d4bb7cc4ecfda85644fc4284f17471
_sync_compute_node should log host and nodename

ResourceTracker:_sync_compute_node logs the host name when it
creates or updates the record for a compute node. However, with
baremetal, one compute_node (host) may actually manage many
separate physical nodes, identified by unique nodenames.

This patch updates the LOG.info calls to include the nodename.

Change-Id: I69c66b84394b2a740a7ca9d2781015a7e1ff9998
Fix rendering of FixedIpNotFoundForNetworkHost

Fixes bug 1104000

With https://review.openstack.org/18319 a small bug was introduced. The
exception FixedIpNotFoundForNetworkHost is expecting network_id
parameter, and the change modified that parameter to network_uuid. This
patch fixes this problem at the raise point.

Change-Id: Idc0fa7fcba9ad37b73183f8811376c6c8adada68
Add debug log when call out to glance

Calling out to another service may take a while, so lets log this

Change-Id: I223105ee578ae82230cbc3936c096e148b07e8f1
Don't warn up front about libvirt loading issues in NWFilterFirewall

Use the same technique as in libvirt/driver.py to delay import of
libvirt module

Change-Id: I500ddde4651f0f747c54533a1a308eee5a87f717
Fix an error in affinity filters

Fix a call to compute_api.get_all to properly exclude deleted instances.
Add tests to prohibit this error in the future.

After some thought, this can be further optimized to let the instance
query do all the filtering/matching.

Resolves bug 1107156.

Change-Id: I6d6a6ba44d38d363489853d0407ad4cc94046656
Add Region name to quantum client

Looks like multi-region setups need the region name

Fixes LP# 1081037

DocImpact

Change-Id: Id8d5b1e1adef75a93df9a3527fd6da463fed0d09
Use install_venv_common.py from oslo.

This syncs install_venv_common.py from oslo and reworks the
tools/install_venv.py script to use the new library.

Change-Id: I020eae1ec9e3a6aae0ecc7825c0ef723ab247f39
Fix missing wrap_db_error for Session.execute() method

We should add wrap_db_error for Session.execute() method, because
Query.update() method will call Session.execute() and it is not inside
Session.flush(), so exceptions from Query.update() wouldn't be wrapped.

Add test for Session.flush() wrapper
Add test for Session.execute() wrapper

Fixes bug 1107890

Change-Id: I96894e502f9f279999b61a1e66469e34a07a022d
Finer access control in os-volume_attachments

Allows policy.json access controls to authorize requests for specific
actions, rather than just being an all or nothing control for the entire
extension.

Bug 1108222
DocImpact
Change-Id: I78e1f596f22434a73bec3952ed024e4d58faac51
Fix authorized_keys file permissions

Explicitly set the file permissions to be 0600

Fixes LP# 1107908

Change-Id: Ife44deff41959180d31e7e88c29233e9b8cb0af2
Fix boot with image not active

When boot with image which is not active, nova API response
with http status code 500. We should catch the exception and
raise HTTPBadRequest with more precise information.

Fix LP# 1108645

Change-Id: Ibd78f4b96bfdb925b03d7809d4e28afcc7e1ddcf
Pass parameter 'filter' back to model layer

This allows the API to pass back additional arguments to filter search
results by.  This will be useful for resource tagging or other filters.

DocImpact: Adds 'Filter' parameter to DescribeInstance (see
http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ApiReference-query-DescribeInstances.html)

Fixes: bug #922835

Change-Id: I58cc12df650829ed7eb685184a22186d8a5406f4
Signed-off-by: Stephen Gran <stephen.gran@guardian.co.uk>
Change ''' to """ in bin/nova-{novncproxy,spicehtml5proxy}

Standard practice is for doc comment strings to be enclosed
in """ rather than '''. bin/nova-{novncproxy,spicehtml5proxy}
were exceptions to this.

Change-Id: I689063af2a51b26c971336b6fdbe60d5695b3ebc
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Refactor libvirt volume driver classes to reduce duplication

Most of the libvirt volume driver class repeat the same setup
of the vconfig.LibvirtConfigGuestDisk() instance. Create a
more suitable base class to hold this common setup and simplify
all the other subclasses accordingly

Change-Id: I9a5a70ccf88a1e55cdb120c8c6d29e6847774691
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Adds API Sample tests for os-instance_usage_audit_log extension.

Fixes Bug 1091752.
Partially implements bp nova-api-samples.

Change-Id: I2db83ac32283795ab0cbf254c6adbd352806b297
Add instance_fault_create() to conductor

This moves the use of db.instance_fault_create() from the compute
utils to conductor.

Related to blueprint no-db-compute

Change-Id: If089ce1623374a259a2d63a99befc46fa3a130b6