Enforce authenticated connections to libvirt

Authenticated connections for both reads and writes
increases VM security.

The virConnectOpenAuth API is flexible, it effectively
obsoletes virConnectOpen and virConnectOpenReadOnly.
ReadOnly access, with its reduced access to the API,
is obtained by passing in the vir connect flag
VIR_CONNECT_RO (=1)

An added advantage of using openAuth is the fewer API calls
that need to be maintained in the nova libvirt driver.

Removed virConnectOpenReadOnly methods and tests.

Change-Id: I6cb3825d1225807955177d7500899babbb569e20
Switch to Oslo-Incubator's EnvFilter rootwrap

Nova-Network used to have its own class for DnsMasq rootwrap
filtering. This was generalized into a new EnvFilter rootwrap
filter that can specify both commands and environments to pass.

Update to openstack.common.rootwrap to git a117358 of
oslo-incubator's rootwrap. This includes the following commits
merged from oslo:

    3b16d31 Remove DnsmasqFilter and DeprecatedDnsmasqFilter
    f9d1a59 Handle empty arglists in Filters
    233baa2 Handle empty PATH environment variable
    3e74c00 Add IpFilter, IPNetnsExecFilter and EnvFilter
    8b95b1e Handle relative path arguments in Killfilter
    7119e29 Enable hacking H404 test.
    ea78eec Update KillFilter to stop at '\0' for readlink() function.

Related to: blueprint quantum-common-rootwrap

Change-Id: I125e5724259850dc4768fb236cbfa5df199008c0
Sync models with migrations

Fixed bugs:
- wrong type instead of MediumText (InstanceInfoCache, Instance, ComputeNode),
- skipped indexes (SecurityGroup, Instance),
- wrong length of column (ComputeNodeStat),
- wrong order of columns in index (KeyPair),
- missing name of UniwueConstraint (InstanceGroup).

bp: db-sync-models-with-migrations

Change-Id: Id698fabd553a10326d984f88fc9580d88cd2a22e
maint: remove redundant default=None for config options

These 73 instances were inconsistent and redundant.

Change-Id: I298f2406535d0805caebdca4f2729d720dd5222f
Remove old legacy network info model in libvirt driver

Update libvirt driver, virt firewall and hypervisor unit tests to
use nova.network.model instead of legacy "network,mapping" tuple.

Partly implement blueprint nova-network-legacy

Co-author: Amir Sadoughi<amir.sadoughi@gmail.com>
Change-Id: I4d38bb81a4f64efdb78f5da52fbbb382981e0b96
Removed code for modular exponentiation, pow() already does this

Change-Id: If21cbcbeb60618769e1659a90381416dfc43ebc4
Cleanup exception handling on evacuate

Some cleanup around catchall exception handing
on evacuate v2 extension to bring it in line
with v3 exception handling. Tests included.

Fixes bug 1210570

Change-Id: I2f2f958acb80240c0fb25f3d538fa204611a33d1
Improve performance of driver's get_available_nodes

get_available_nodes() is called every time an instance is updated.  That
ends up calling get_host_stats(refresh=True), resulting in a
libvirt/XenAPI/etc call.  On a build of a new instance when the instance
record is updated often (task_state and progress), this results in a lot
of unnecessary driver calls.

This changes get_available_nodes() to take a refresh kwarg to pass
through to get_host_stats(), defaulting to False so that it uses
the cache.  Places that used get_available_nodes() and are sensitive to
stale data are changed to add refresh=True.  Also adds a helper driver
method for 'is_node_available'.  And make sure that even if drivers'
get_host_stats() methods get refresh=False that they refresh when they
have no stats.

Fixes bug 1210264

Change-Id: I22c8d70e3e70f2d2421915da66c2618688e0db2b
Fix H501: Do not use locals() for string formatting

Change-Id: Ide587d3311c22f698a82eeee210c5bdbe24eb484
Remove clear_rabbit_queues script

The clear_rabbit_queues script has been around forever, but it doesn't
appear to be widely used - e.g. there is no user documentation for it
and I don't see any mentions of it on mailing lists or Q&A forums.

Also, RabbitMQ now includes a management plugin and CLI which allows
you do do e.g.

  $> rabbitmqadmin delete queue name=$topic
  $> rabbitmqadmin delete queue name=$topic.$host
  $> rabbitmqadmin delete exchange name=nova

oslo.messaging does not expose an API equivalent of this command since
even the existance of a queue is transport driver specific. We could
consider adding transport-specific admin CLIs, but probably not where
the transport already has suitable admin CLIs elsewhere.

For reference, this script was added by this merge:

  https://code.launchpad.net/~mdragon/nova/lp794635/+merge/71437

blueprint: oslo.messaging
Change-Id: If5e6354e8ace4c0b4425c96de558a5cbab4c98bd
Port "Accept is_public=None .." to v3 tree

The following commit(I2a9b1c24cd744c8819c1d41e0ad103d05398401c) have
not been merged to v3 tree now, because the commit was merged to the
existing api after porting flavors.py to v3 tree.

    commit 645c2d3a06bbf8b0854ebcc539ad33dd706866c5
    Author: Xavier Queralt <xqueralt@redhat.com>
    Date:   Wed Jun 12 14:59:29 2013 +0200

        Accept is_public=None when listing all flavors

This patch ports the commit to v3 tree.

Partially implements blueprint nova-v3-api

Change-Id: Id1ff1366c16f0caac50e279b2add5ec9d9b9bf5f
Fixes typo in __doc__ of /libvirt/blockinfo.py

Just a few spelling mistakes

Change-Id: I90e8d9dfe105e3968caf525e2f8f483da3636598
Moved tests for server.delete

* moved tests to separate class
* removed some code duplication

blueprint api-compute-servers-tests

Change-Id: Ib281990528595baf52f08af0ece5a7bde39c55ee
Fix leaking of image BDMs

Patch Ia89d531be71c460f1f82fcfce34b270639a23061 introduce creating an
image block device for every instance, to comply with the new block
device format being introduced currently.

However, due to a mistake during rebase the needed code to delete those
once the instance was being deleted was broken (even though comments
suggest otherwise).

This patch now fixes this issue, by adding a proper flag to the
conductor call when getting BDMs in compute manager's _complete_deletion
method.

Fixes bug: #1206890

Change-Id: I6a9673758b0762f99f27860b8f88a16127da7399
Moves compute.rpcapi.prep_resize call to conductor

This patch moves the prep_resize logic out of scheduler.manager
and creates it on conductor.manager.ComputeTaskManager.

Partially implements bp cold-migrations-to-conductor

Change-Id: I8458071fb13505f55f8d2155c9ec5ee938b1005f
Add option for QEMU Gluster libgfapi support

If gluster is present in qemu_allowed_storage_drivers, glusterfs's
backend will pass a disk configuration to QEMU. This allows QEMU to
access the volume using libgfapi rather than mounting GlusterFS via
fuse.

Implements blueprint glusterfs-native-support
DocImpact

Co-authored-by: Flavio Percoco <flavio@redhat.com>
Change-Id: I939cac05ee333b77abcaa9bd132d5eb3308e60ff
Merge "Fixes typo in __doc__ of /libvirt/blockinfo.py"
Merge "Fix leaking of image BDMs"
Merge "Moved tests for server.delete"
Merge "Enforce authenticated connections to libvirt"