Open stable/havana

Change-Id: Id71eac8d7ec0cc0eca657b1681ebd65daf3bdc40
Ensure autoscaling actions occur for percentage adjustment

Fixes bug 1251007

Previously if the AdjustmentType was set to PercentChangeInCapacity,
then depending on the choice of the instance group MinSize and the
scale-up policy ScalingAdjustment, no autoscaling actions may occur
even when the under-scaled alarm fires.

This situation occurred if:

   (MinSize * ScalingAdjustment / 100.0) < 1.0

in which case the group never get gets scaled up even if the under-
scaled alarm stays in the alarm state forever.

Now we follow the rounding rules used by AWS Autoscaling:

  http://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/as-scale-based-on-demand.html

Change-Id: I79e5e743de1944ace5ef2c4dbcb76c9cab7262bb
(cherry picked from commit 5720e6d647ce3a273d638fd7dacc9c2d6eb2bc22)
Use all available headroom for autoscaling

Fixes bug 1254796

Previously, potential headroom for autoscaling group growth
or shrinkage would remain unused unless the adjustment exactly
hit the max or min size respectively.

Now, we truncate the adjustment to the upper or lower bound
in the case of an over-shoot.

Change-Id: I760be999039f7038dab77cb8b77a0f683ef56db3
Properly reconnect subscribing clients when QPID broker restarts

This is a cherrypick of oslo-incubator:
e227c0ed7e0ed1f9b8d029336f8aeb60e38c23df

From the oslo-incubator bug:
When the QPID broker is restarted (or fails over), subscribed clients
will attempt to re-establish their connections.  In the case of fanout
subscriptions, this reconnection functionality is broken. For version
1 topologies, the clients attempt to reconnect twice to the same
exclusive address - which is illegal.  In the case of version 2
topologies, the address parsing is broken and an illegal address is
created on reconnect.  This fix avoids the problem by removing the
special-case reconnect code that manages UUID addresses; it is
unnecessary as the QPID broker will generate unique queue names
automatically when the clients reconnect.

Change-Id: I563db129e63817ad55165e318f164f06b141ee33
Closes-Bug: 1251757
Sync rpc fix from oslo-incubator

Sync the following fixes from oslo-incubator:

ef406a2 Create a shared queue for QPID topic consumers

Closes-bug: #1257293
Change-Id: Id0e1d9704ef1cb506ae68c3848f8615e7e364484
Fix missing policy enforcement in CFN API

Currently the CreateStack and UpdateStack actions aren't correctly
enforcing the policy, so add calls to _enforce which fixes that,
and rework the test to illustrate the issue.

Change-Id: Ia5c2e65512ab9d1c163171f8617c081ab96745e5
Closes-Bug: #1256049
Deny API requests where context doesn't match path

We shouldn't overwrite the context tenant_id (which comes from the
scope of the auth_token) with that from the path, instead raise a
HTTPForbidden exception if the path-provided tenant_id doesn't match
the context.

Change-Id: Ib6fb9881103312f7492081a20178f12309f35d81
Closes-Bug: #1256983
Updated from global requirements

Change-Id: I9d8c343c49846aefb2368ba47595ec6f3c8c7031
Merge "Fix missing policy enforcement in CFN API" into stable/havana
Merge "Deny API requests where context doesn't match path" into stable/havana
Switch to using M2Crypto

This patch uses M2Crypto instead of PyCrypto to perform encryption
and decryption of user authentication information.
remove pbr runtime dependency
Fix dependencies for EPEL