Remove nova-compute from boot-stack dependencies.

As things have been factored out, boot-stack no longer implies
nova-compute on the same host. This specifically addresses the case
where we build the overcloud-control image and it fails to restart
nova-compute during post-configure because nova-compute defaults to
libvirt, but libvirt is only installed by the nova-kvm element.

Change-Id: I3cba8a48c64d3919898d4ea47a6cd7808327cd9c
Use o-r-c instead of first-boot.d for iptables.

This is the only use of first-boot.d, which is somewhat problematic for
a number of reasons. Using o-r-c the script can be made semi-idempotent
and then we can consider eliminating first-boot.d from
diskimage-builder.

Change-Id: I6e675d4fddda44af388eb5eaea7b3a9697092948
Capture our heuristics for configuration.

Right now it's only hinted at in incubator + a single email. Lets have
a place to point folk at to read about it. Alternatively we could put
it in incubator, but I think the image-elements repository is shaping
up to be the prime repository of code for us.

Change-Id: Ief5a33887239d313a76dfca5cd78c6f9263873bf
Merge "Capture our heuristics for configuration."
Drop EC2 credential generation from init-keystone.

We don't use the EC2 credentials in any of our tooling, and they can
be created by an external API script should they be needed.

Change-Id: I1bf845cf2db339e127b8a12bab64890a46d9dd19
Assume we always have /etc/keystone/keystone.conf.

We're not running in semi-installed mode: os-apply-config always
creates keystone.conf for us, so we can be more direct in our logic.

Change-Id: I2965af54dd910ccb681d3ce1819be17a32046b33
Remove invis-to-admin initial tenant.

We don't use it, it's for devstack demo purposes, which is
inappropriate for a production targeted deployment.

Change-Id: Iccd2c75661f5cbc9a4770ea93660126b2b1dfae7
Remove unneeded roles.

We only need the admin and member roles: the other ones were
illustrative from devstack, but not relevant to the current production
setup.

Change-Id: I32e601a3ecc97d6469043df824c8aae064c00d5e
Don't double restart glance-* services.

The init-openstack script restarts glance services that are also
restarted by the glance elements os-refresh-config hooks. We don't
manipulate glance in-image now, so we can just wait for them to
restart post-configure.

Change-Id: I7bbac7b5103bf5196b7a05ee87d154a2558fb31d
Don't double-restart nova-api.

Similar to glance, we used to poke at nova during in-instance setup
but that has been moved to API scripts from the deployer now, so we
don't need to force service availability before the rest of
os-refresh-config runs.

Change-Id: I83c9c53d8dcd38fba5bbfb603ca8d183a5efc63e
Drop heat-localip.

We only needed heat-localip to work around a race condition in our
heat templates. Those templates are now fixed, so there is no need to
have heat-localip at all.

Change-Id: I779931e523d0082367c5602507eab10d190839c5