Permit using different libvirt hypervisors.

Folk will want to deploy lxc/qemu etc overclouds. The libvirt type
needs to be controllable for this, independent of software
installation.

Change-Id: I29e5fea72f9cb983576410baa8f50ab060c08fe3
Remove deprecated and unused nova setting.

Change-Id: I01a7c0b5faac0338594988b2e69981aad215cb33
Remove in-instance network policy configuration.

Network policy should be driven by API clients rather than in-instance
scripts, as using Heat to proxy the handover just adds an unnecessary
layer of indirection. We need to keep the logic for configuring ovs
within instances, just not the neutron net-create etc.

Change-Id: Iaee70ef5c9d1ff2a608e4ea64e766920bfba7f42
Setup ovs bridges before we start services.

The ovs bridges need to be setup before we start any neutron services
that depend on them. The right way to do that is to set them up during
configure, and start services in post-configure.

Change-Id: I316e0d4a9e71479ea2e9ae338d243b4cec5391b8
Move the metadata NAT rule to nova-baremetal.

It was part of the openvswitch agent rules, which is entirely
inappropriate for overclouds.

Change-Id: I43faa086f5625434f9abdea68a3bb88413688d4c
Set a bridge id for external bridges.

Unlike br-int we were not setting a bridge-id. I'm not sure if it's
needed, but it is consistent to add one, and will allow consolidating
other code which currently differs only by setting such an id.

Change-Id: I0e5ada816948cc7fd3a5fe7b5b92b7bb89ebaf5a
Update network configuration for overclouds.

The overcloud network configuration was not migrating ip addresses and
ports onto the exterior integration bridge. This is fine when the
bridge is not the default route, and/or is on a different interface,
but behaves very poorly when only a single interface is present. Since
we don't use br-ex in undercloud setups (today), and don't use
br-ctlplane in overcloud setups, we can use the same code for
migrating address and routes by updating our configuration instead.

Change-Id: I85a455bd2b03089bf39c34a3b69af78af09ce286
Install kpartx for nova-kvm.

Nova invokes kpartx directly to do file injection (ugh), so we need it
installed on the nova-kvm compute hosts.

Fixes bug: 1211170

Change-Id: I67f677f91df5f4340ceaa14efde1945e7d4218f6
Remove nova-compute from boot-stack dependencies.

As things have been factored out, boot-stack no longer implies
nova-compute on the same host. This specifically addresses the case
where we build the overcloud-control image and it fails to restart
nova-compute during post-configure because nova-compute defaults to
libvirt, but libvirt is only installed by the nova-kvm element.

Change-Id: I3cba8a48c64d3919898d4ea47a6cd7808327cd9c
Use o-r-c instead of first-boot.d for iptables.

This is the only use of first-boot.d, which is somewhat problematic for
a number of reasons. Using o-r-c the script can be made semi-idempotent
and then we can consider eliminating first-boot.d from
diskimage-builder.

Change-Id: I6e675d4fddda44af388eb5eaea7b3a9697092948
Capture our heuristics for configuration.

Right now it's only hinted at in incubator + a single email. Lets have
a place to point folk at to read about it. Alternatively we could put
it in incubator, but I think the image-elements repository is shaping
up to be the prime repository of code for us.

Change-Id: Ief5a33887239d313a76dfca5cd78c6f9263873bf
Merge "Capture our heuristics for configuration."
Drop EC2 credential generation from init-keystone.

We don't use the EC2 credentials in any of our tooling, and they can
be created by an external API script should they be needed.

Change-Id: I1bf845cf2db339e127b8a12bab64890a46d9dd19
Assume we always have /etc/keystone/keystone.conf.

We're not running in semi-installed mode: os-apply-config always
creates keystone.conf for us, so we can be more direct in our logic.

Change-Id: I2965af54dd910ccb681d3ce1819be17a32046b33
Remove invis-to-admin initial tenant.

We don't use it, it's for devstack demo purposes, which is
inappropriate for a production targeted deployment.

Change-Id: Iccd2c75661f5cbc9a4770ea93660126b2b1dfae7
Remove unneeded roles.

We only need the admin and member roles: the other ones were
illustrative from devstack, but not relevant to the current production
setup.

Change-Id: I32e601a3ecc97d6469043df824c8aae064c00d5e
Don't double restart glance-* services.

The init-openstack script restarts glance services that are also
restarted by the glance elements os-refresh-config hooks. We don't
manipulate glance in-image now, so we can just wait for them to
restart post-configure.

Change-Id: I7bbac7b5103bf5196b7a05ee87d154a2558fb31d
Don't double-restart nova-api.

Similar to glance, we used to poke at nova during in-instance setup
but that has been moved to API scripts from the deployer now, so we
don't need to force service availability before the rest of
os-refresh-config runs.

Change-Id: I83c9c53d8dcd38fba5bbfb603ca8d183a5efc63e
Drop heat-localip.

We only needed heat-localip to work around a race condition in our
heat templates. Those templates are now fixed, so there is no need to
have heat-localip at all.

Change-Id: I779931e523d0082367c5602507eab10d190839c5