Fix floating ips with external gateway

If dnsmasq is configured to use an external gateway, then floating
ips on other interfaces do not work properly. This is because
outgoing traffic is no longer snatted to the floating ip.

This patch fixes it by adding an ebtables rule to force traffic
from ips that have a floating ip associated to route instead
of bridge.

Fixes bug 1096985

Change-Id: I8e4904660d42fe51c44b66686bed9f5d622693bd
Add version constraint for cinder

Cinder client usage requires the "retries" parameter introduced in
cinderclient-1.0.1. This should be a constraint in pip-requires.

Change-Id: I36e8a363c9d4bb7cc4ecfda85644fc4284f17471
_sync_compute_node should log host and nodename

ResourceTracker:_sync_compute_node logs the host name when it
creates or updates the record for a compute node. However, with
baremetal, one compute_node (host) may actually manage many
separate physical nodes, identified by unique nodenames.

This patch updates the LOG.info calls to include the nodename.

Change-Id: I69c66b84394b2a740a7ca9d2781015a7e1ff9998
Merge LibvirtBridgeDriver class into LibvirtGenericVIFDriver

This introduces the LibvirtGenericVIFDriver class which uses
the 'vif_type' mapping field to determine what type of host
network configuration is required.

The LibvirtBridgeDriver class functionality is merged into
LibvirtGenericVIFDriver. For backwards compatibility with
the Folsom release, the existing LibvirtBridgeDriver class
is made to inherit from LibvirtGenericVIFDriver and directly
call the bridge specific setup APIs. This eases migration to
the new VIF impl during the Grizzly deployment lifecycle, with
an expectation that the LibvirtBridgeDriver stub will be
deleted in the Hxxxxx release.

DocImpact
Blueprint: libvirt-vif-driver
Change-Id: I948158b5ee0a97f666bb4d21020b552d3475b6d3
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
iptables-restore error when table not loaded.

When adding openstack rules, if a table module is not loaded,
the resulted file doesn't include the section for the missing
table, making new rules added to it, out of place and
a no valid file for iptables-restore

Fixes bug #1103436

Change-Id: I34ae51a23efec57bfec37b8fa378d043fcf62d70
Fix an error in affinity filters

Fix a call to compute_api.get_all to properly exclude deleted instances.
Add tests to prohibit this error in the future.

After some thought, this can be further optimized to let the instance
query do all the filtering/matching.

Resolves bug 1107156.

Change-Id: I6d6a6ba44d38d363489853d0407ad4cc94046656
Make sure there are no unused import

Remove all currently unused imports
Prevent future unused imports

Change-Id: I6ac26d5c71b79952a7732db300355a00310c712e
Stop including full service catalog in each RPC msg

The service catalog is included in the context to get the cinder API
endpoints.  Instead of passing entire service catalog just for cinder
endpoint, just include cinder endpoint in context.service_catalog

Change-Id: Ic39173f0a2f330dbd78daa786b269f29ac4abf33
Finer access control in os-volume_attachments

Allows policy.json access controls to authorize requests for specific
actions, rather than just being an all or nothing control for the entire
extension.

Bug 1108222
DocImpact
Change-Id: I78e1f596f22434a73bec3952ed024e4d58faac51
Fix authorized_keys file permissions

Explicitly set the file permissions to be 0600

Fixes LP# 1107908

Change-Id: Ife44deff41959180d31e7e88c29233e9b8cb0af2
refactored data upgrade tests in test_migrations

The one off testing in test_migrations was starting to get obtuse
enough that it was possible for bugs to slip through (which they
did already). Create a more general framework for testing data
transitions at any db migration.

Hook the walk_versions code so as we are about to upgrade to a
migration point, attempt to run a _prerun_### function, then follow
it up with a _check_### function afterwards. Create some utility
functions to make doing things in these _prerun and _check functions
pretty concise.

This makes these checks db independent, and has it so they'll run
however we are running the walk_versions.

In doing so, this uncovered a bug in the 147 migration, which is
fixed inline. There is no retroactive fix, as 147 was destructive to
data, so would have nuked anyone that hit it already.

Updated to remove safe_getattr, thanks to jerdfelt for pointer on
doing that right.

Partially implements blueprint migration-testing-with-data

Fixes bug #1108448

Change-Id: I8bd92e3688109bfbdf1da21a175055b7263abf45
Change ''' to """ in bin/nova-{novncproxy,spicehtml5proxy}

Standard practice is for doc comment strings to be enclosed
in """ rather than '''. bin/nova-{novncproxy,spicehtml5proxy}
were exceptions to this.

Change-Id: I689063af2a51b26c971336b6fdbe60d5695b3ebc
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Merge "Stop including full service catalog in each RPC msg"
Merge "Make sure there are no unused import"
Merge "iptables-restore error when table not loaded."
Merge "Merge LibvirtBridgeDriver class into LibvirtGenericVIFDriver"
validate specified volumes to boot from at the API layer

This causes the create to fail fast instead of putting
the instance into error later in the process.

Related to bug: 1069904
Change-Id: I5f7c8d20d3ebf33ce1ce64bf0a8418bd2b5a6411
Merge "refactored data upgrade tests in test_migrations"
Adds API Sample tests for os-instance_usage_audit_log extension.

Fixes Bug 1091752.
Partially implements bp nova-api-samples.

Change-Id: I2db83ac32283795ab0cbf254c6adbd352806b297
Add instance_fault_create() to conductor

This moves the use of db.instance_fault_create() from the compute
utils to conductor.

Related to blueprint no-db-compute

Change-Id: If089ce1623374a259a2d63a99befc46fa3a130b6