Relax API restrictions around the use of reboot

Fixes bug 1101082 bug 982108

Reboots are the only sledge hammer users have available to resolve
issues with their instances without administrative intervention.
This patch modifies the API policy to allow reboot calls to be made
in many more power and task states.

Change-Id: Ia8702448f6b7b863da40e4d498f2e2ee0a12882e
Add option to control where bridges forward

This adds a new config option to control where bridges can forward.
The default behavior is unchanged, but if you specify:

forward_bridge_interface=foo

Then only traffic on the same bridge or going to and from the foo
interface will be allowed. This is useful in vlan mode when a
deployer doesn't want traffic to be routed between vlans. Note
that forward_bridge_interface can be specified multiple times and
should be specified once for each interface that supports floating
ips. i.e.:

forward_bridge_interface=eth0.10
forward_bridge_interface=eth0.20

DocImpact

Change-Id: I82d6b288b60cd6deae64690b55546730b1c2da55
Extend extension_authorizer to enable cleaner code.

I have seen and used two different methods for authorizing multiple
methods in a class, and both use code duplication that won't be
necessary with this patch.

The first method involves creating multiple authorizers, which can get
out of hand quickly.  i.e.:

authorize_attach_index = extensions.extension_authorizer('compute',
                                                'volume_attachments:index')
authorize_attach_show = extensions.extension_authorizer('compute',
                                                'volume_attachments:show')

The second method involves creating an intermediate method in the
extension like:

def authorize(context, action_name):
    action = 'os-networksv2:%s' % action_name
    extensions.extension_authorizer('compute', action)(context)

but this ends up getting duplicated in each file.  This patch allows
extensions to use the authorizers they already have but gives them finer
control by passing something like "action='index'" to the authorizer.

Change-Id: I6371b2c631acc9345ee6ca4672afa1f49781f22b
Condense multiple authorizers into a single one.

Reduces code duplication by creating a single authorizer and passing in
the action that should be checked against policy.

Change-Id: I33cfee8695ddfbba39038fbc608c6c74d258745f
instance.update notifications don't always identify the service

instance_update in conductor/manager.py doesn't identify the service
when calling notifications.send_update(), resulting in mesages on the
notification queue having a service value of None.

This change makes sure that the correct service is identified even
when running conductor in local mode

Change-Id: I1b22c0b46040f51ba715a4d9fa19ef4c98359070
import tools/flakes from oslo

Change-Id: Id6d99fe1fd39e8c061f591e9a82058aea9664674
Mark password config options with secret

Config object supports masking values when writing out if the secret
flag is set on the option definition.  This change flags all nova
options containing a password.

Change-Id: I538c93bac736c317822b5d78b53c4181b2009b49
Make system_metadata update in place

This makes the system_metadata updated in-place like regular
metadata during instance_update(). It also modifies that function
to avoid actually removing the item from the list, which will cause it
to be deleted from the database when the session ends. The soft_delete
is sufficient for our purposes.

Related to blueprint no-db-compute

Change-Id: I0da28ec485dc7850d246dab0a2bb95ae10c05c3e
Tweakify is_valid_boolstr().

This function used a few backslashes for continuation.  According to
HACKING, we prefer to not use this.  This code gets rid of them by
changing the way the checks are done.

Look at those backslashes ... sitting there at the end of the line.
It's like they're looking down on the code that precedes them, as if
they are somehow superior to the other characters.  Banish them from
this utility function!

Also add a unit test for this code.

Part of greenprint bored-on-an-airplane.

Change-Id: If88b6e63ab078916ce1b9cf2f5e99623c402996c
Reimplement is_valid_ipv4().

This patch reimplements the is_valid_ipv4() function is nova.utils.
Instead of open-coding the validity check, just make use of the netaddr
module, which is already used elsewhere in nova.utils.

Also add a unit test for this code.

Part of indigoprint bored-on-an-airplane.

Change-Id: Ia89cbbd94a0ac4631d794d658b53c244237e1ca2
Merge "Extend extension_authorizer to enable cleaner code."
Merge "Condense multiple authorizers into a single one."
Merge "import tools/flakes from oslo"
Optimize floating ip list to make one db query

Currently the floating ip code will make 2 db queries for every
single associated floating ip when list is called. This adds
a couple of joins in the db layer to avoid having to make so many
calls. This dramatically improves floating-ip-list. On a simple one
node test the time dropped from 2.35 seconds down to 0.5 seconds
for a list with 10 associated floating ips.

Part of blueprint optimize-nova-network

Change-Id: I0571013393b2dbad42c15e690c7783d5ceecaeb2
Merge "instance.update notifications don't always identify the service"
Merge "Add option to control where bridges forward"
Merge "Relax API restrictions around the use of reboot"
Imported Translations from Transifex

Change-Id: Ideb135261b0f9b2c32b118e7dd033809a14acdcd
Make NFS mount hashes consistent with Cinder

Cinder is using a different hash method for mount point uniqueness.
This change makes Nova's hash method identical.

Change-Id: I64e0200ae341fa90cf66b86fa3cb11ad02e773c6
Merge "Make system_metadata update in place"