Updated openstack/openstack
Project: openstack/nova  9b7a2ce70a50341187542a07cec39fbb8c1168d7
null
Fixes evacuate doesn't honor enable password conf for v3

The evacuate api should honor enable_instance_password conf
setting just like server creation, rebuild and rescue api does,
enables this flag will returning the instance password from
server API call evacuate, If the hypervisor does not support
password injection then the password returned will not be
correct, this patch just fixes v3 evacuate api, since change
return value of v2 could potentially break apps which depend
on this being returned.

This patch also changes the evacuate response code to 202 to
keep consistency with api.

DocImpact
Change-Id: I2b9e5a067323ca84e2040e175a0425de3c0fafba
Closes-Bug: #1244203
Updated openstack/openstack
Project: openstack/keystone  2e720b5723f8950ca2d3bf83218321578cc82dae
null
Make domain_id immutable by default

We already allow the domain_id in User, Group and Project entities
to be made immutable by use of a config option.  By default, however,
the domain_id is mutable.

This patch switches this so that the domain_id is immutable by default.
Although this changes existing functionality, it is felt that since
nearly all non-trivial production implementations that use domains
are going to want to restrict domain admin personas with a suitable
policy file, leaving the domain_id mutable by default represents a
potential vunerability that could be exploited.

Closes-Bug: 1294293

Change-Id: I0cb9fd4dc520d0a15bf54f4d138a3794d0ccd1d9