Server secgroups and network/port together invalid

Nova silently ignores security_groups properties for a server if the
server has a 'networks' property that references a neutron port, the
intent being that security groups are assigned to the port(s).

Adds note to Server properties to this effect.
Validation fails for a Server if 'security_groups' is defined AND
the server has neutron Ports assigned.

Change-Id: I883761a0bb0e73a3fcc7c362d8e6dc5a099806e0
Closes-Bug: #1270313
Order imports in alphabetical order (2/9)

This patch is one in a series to re-enable H306 style check rule
(imports are in alphabetical order). It touches API files.

Implements: blueprint reduce-flake8-ignored-rules (partial)
Change-Id: I81c7c79516ce1a17055c3b9c12a94312ed3d1940
Order imports in alphabetical order (3/9)

This patch is one in a series to re-enable H306 style check rule
(imports are in alphabetical order). It touches common and cloudinit files.

Implements: blueprint reduce-flake8-ignored-rules (partial)
Change-Id: Ie9838dba11323575165fc3bfdfbd0d0b93f653fa
Remove unused variable

o heat/common/config.py:DEFAULT_PORT = 8000

  This variable was removed in the following commit.

    commit 34e47b64d926c055d9895c5b3f27949eaca68999
    Author: Steve Baker <sbaker@redhat.com>
    Date:   Mon Jul 22 16:01:44 2013 +1200

        Move heat-cfn, heat-boto, heat-watch to new repo

Change-Id: Iab6213eba1422882c92bd16a3351df19869aa9f3
Set statuscode=404 in NotFoundException in tests

when resource can'n be found,neutron will set
statuscode=404 in NotFoundException,so add statuscode
in exception to make fake client have same action.

Change-Id: I6597f080903501d9fe6050893054cc7dba6a595b
Add host_routes property to Neutron subnet resource

Template snippet that was functionally tested:

subnet:
  Type: OS::Neutron::Subnet
  Properties:
    host_routes:
    - {destination: 192.168.1.0/24, nexthop: 192.168.1.2}
    network_id: {Ref: network}
    ip_version: 4
    cidr: 10.0.3.0/24
    allocation_pools:
    - {end: 10.0.3.150, start: 10.0.3.20}

(Next hop probably would make more sense to be in the CIDR)

Change-Id: I36f72f006a1ba48a6ed55a1c361b3df8d1359caa
Closes-Bug: #1250710
Add IP address to error message of failed stack

The error message that occurs when the heat-script.sh or cfn-userdata
script runs doesn't include the IP address of the server, and it's not
possible to find that info in the stack-show output of a failed stack.
Add the IP address to the error message so it is displayed in the
stack-show output to aid in debugging.

Change-Id: I35bd4fbc1a05fa8207f3eb4f501f5becf78415c9
Allow proper instance with volume suspension

When suspending a stack that contains an instance with a volume
attached through the instance's "Volumes" property, the stack will
go into a SUSPEND_COMPLETE state, but the actual instance will still
be in an ACTIVE state. This is because check_suspend_complete will
return TRUE without ever starting the instance's suspend task.
This commit ensures that the instance suspension TaskRunner is
actually started.

Change-Id: I77291d21b291242684cf42e7143b264521ba113e
Closes-Bug: #1284306
Return None when get_attr cannot resolve a value

To prevent validation failures prior to resource creation, get_attr
returns None if the attribute or the sub-value cannot be resolved.
This returns this function to consistency with prior behavior and allows
non-string attribute values to be resolved to their proper default
"empty" data types during initial template validation.

Change-Id: I0e02174c43be65a647358a2047da8213635f85d8
Closes-Bug: 1287397
Allow getting attributes on suspended resources.

A resource which is suspended can legitimately have attributes returned
for it.

Related-Bug: #1286920

Change-Id: I350b2e20e274cce7a0f654cb71f7445632e0e633
Allow handle_signal to assert which actions are valid

This retains the current behaviour for InstanceGroup and Restarter
while allowing other resources to apply different policies about
what actions are allowed when a signal is received. This is needed
by SoftwareDeployment, which can legitimately receive signals
during SUSPEND and DELETE.

Change-Id: I6f694451669b6c9b60b9fbd3ad77d0fc111bbb5a
Closes-Bug: #1286920
Use PluginManager to load resources

Change-Id: If682ca26f9d214a4cfc1b86baa29f87242373f04
Load functions from plugins

Implements blueprint function-plugins

Change-Id: Iad13fd25e3697e3462753dc53ae25418969da8a5
Move HOT parameters code to a separate module

Change-Id: If9755cf20c9f78cf1c93ac571ec1d4b3fdc320dc
Fixup uuid stubbing in test_stack_user.py

As noted in https://review.openstack.org/#/c/71930/13  there is an issue
with using the utils.UUIDStub method to stub the resource ID, because
any events stored also get the same uuid, which can cause sqlalchemy
warnings to be output.  Instead store the resource before setting up the
keystoneclient stub so we know the expected ID to use.

Change-Id: Ia456425384d52b3983b8d1d387f56e57e8b559ee
heat_keystoneclient add legacy fallback path

If users fail to observe the reccomendations in the commit messages
and/or release notes and use a heat.conf from a previous version of
heat currently some functionality will fail due to the missing
domain configuration in heat.conf.  Instead degrade gracefully with
warnings, calling the non-domain functions which are maintained
(for now) for backwards compatibility.

Hopefully we won't have to maintain this huge pile of legacy stuff
for too long :(

Change-Id: Ia029d585dfdb2563609725589c41083819a11a3b
Closes-Bug: #1287980
heat_keystoneclient add delete_stack_domain_user_keypair

Adds function to delete a credential containing a keypair, since we
do this as admin we also sanity check to ensure the user associated
is a stack domain user, if not we should fall back to the non-admin
path

Change-Id: Ie15958f91b6b80b4a3f0b73943345b7d27566077
blueprint: instance-users
StackUser add suspend/resume support

Adds suspend resume support which will be required to migrate the
User resource to this base class without losing functionality

Change-Id: I3607ef71bfcd863b08879b3856baa92e7aeeef10
blueprint: instance-users
Add test for StackUser._create_keypair

Currently _create_keypair is only indirectly tested via SignalResponder
so add a base-class-specific test.

Change-Id: Ic9f1df06df25205f864b2f0138d2821089608b88
blueprint: instance-users
Allows vip from a different subnet for lbaas resource

This fix allows user to specify a different subnet while adding
a vip to a pool resource. If vip subnet is not provided, pool
subnet is used by default.

Change-Id: I0b7740ca37961ae412866cc15ab439dafbfcf9d9
Closes-Bug: #1286001