Use source-repository interface in heat-cfntools

Change-Id: I2d6e71112b5f924087caf29cbab620205fe5234a
Restart rabbitmq-server in case of failure

RabbitMQ is a critical service in our system and should therefore
be restarted in case of failure. No logs will be lost as they can be
recovered from systemd journal.

Change-Id: If5416ecc636e199d639be2c6bb8777326e7ea659
Merge "Restart rabbitmq-server in case of failure"
Update cached metadata with heat-localip.

Previously we only updated the cfn-init-data that was written to disk on
first boot. However, cfn-hup will be writing to the cached last_metadata
file, which is what os-apply-config will read if it exists.

Change-Id: I48800908d67a96c1bca588972db7838264eaace2
Fix seed MASQUERADE rules.

The seed node config had a host specified rather than a network for
MASQUERADE. Anyone following devtest would have had no outbound
connectivity from booted nodes (except to 192.168.122.1).

Change-Id: I37d335bc6c1316e38f8e1119899245dd491a4098
Merge "Fix seed MASQUERADE rules."
Fix neutron-openvswitch-agent.service on fedora

The service is unable start because the neutron
user is unable to sudo.

Fixes: bug #1200409

Change-Id: Id22e3dd46226f6c4151b81a03c268ae5583d98f5
Merge "Fix neutron-openvswitch-agent.service on fedora"
Improve openstack-clients element.

Add keystone to the list of installed clients. Expanding this element
allows other elements, such as nagios to consistently install the
openstack clients with out having to duplicate code or depend on the
entire services element, in this case, Keystone to get the client.

Change-Id: I71e82dbf5e7d95a063ac8755c2cfc93a18ab6fb9
Authored-by: Chris Krelle <nobodycam@gmail.com>
Stop creating disk images during wipe-openstack.

Our principled separation of concern places one-time setup like flavor
creation and baremetal deploy ramdisk creation and registration
outside the boot-stack problem-space. The incubator devtest story now
does that, so doing it here is just redundant.

Change-Id: I63cf52b6dca48f8f75b550388c6912eda5c0f533
Merge "Improve openstack-clients element."
Reinstate architecture binding for nova-bm.

Per bug 1201656 (which this doesn't fix) nova is constrained to run
one architecture per nova-compute host.

Change-Id: I352f219f3ebb05705adf4bc6815ab738a0599c6b
Add "install from directory" to os-svc-install

This will allow elements to install from a directory that has
been downloaded by the source-repositories element.

In cases where this install method is used no attempt is made
to verify the directory being installed from. The assumption is
that the source-repositories element errors if multiple elements
try to download to the same directory. Its also assumed that the
repository version downloaded is correct as this can now be set
by the process running d-i-b and the element shouldn't be aware
of it.

Change-Id: Iceada839f0418789156741b56979c4a287a9a24d
Merge "Add "install from directory" to os-svc-install"
Fix nova-bm-dnsmasq.service

[/usr/lib/systemd/system/nova-bm-dnsmasq.service:9] Unknown lvalue
'-ExecStartPre' in section 'Service'

Adding a - to ExecStartPre causes systemd to ignore
the exit code but the "-" was in the wrong place.

Change-Id: I2a62f48b307f09aa23603d97066e6a1c9c76135f
Fedora firewall changes

Allow access to
 - Metadata API (8775)
 - Neutron API  (9696)
 - AMQP         (5672)

Deny access to dhcp, specific MAC's are granted access by
elements/nova-baremetal/bin/filter-bootps

Change-Id: If2af136caaa28a6553f3f0579c91aa53a6dfb74e
Configure polkit to allow nova to use libvirt

Change-Id: I7808055ff978ace362c56a37cd09e85b29ad013c
Merge "Fedora firewall changes"
Merge "Configure polkit to allow nova to use libvirt"
Remove os-refresh-config call from wipe-openstack.

Previously we were running os-refresh-config to make sure we
caught everything that had been refactored into orc scripts. After
analysis, it seems that the only thing we need before init-neutron is
init-neutron-ovs. This is called later in the orc chain, so we have
split wipe-openstack's call to init-neutron out into 85-init-neutron.

In addition, there was a check for "is it already running" behavior that
is no longer needed since we should only have one orc running at a time
with the impending lock change. We have removed that behavior.

Finally the init/wipe scripts don't need to be in the system PATH and thus
have been merged with their orc scripts, which were their only callers.

Change-Id: I407678104353b180102e16894408c3ffa2d7db90