Fix signal handling for WSGI servers

Previously, sending a SIGHUP to the parent process would close the
shared socket used with all the WSGI servers (problematic when multiple
workers are present). Also, exiting the wait loop in the parent would
cause the children to be orphaned. Instead, make the parent process
restart all the children servers upon receipt of SIGHUP. This behavior
seems to make sense given that sending SIGHUP to a child restarts and
creates a new server (due to the parent handling of the children).

Another fix was to issue a SIGTERM upon Ctrl-C in order to not leave
parentless children. SIGTERM was chosen instead of SIGINT simply to
avoid worker tracebacks on the terminal.

Minor unrelated change: the WSGI server in single worker mode has been
changed to also respect the debug flag, exactly the same as with
multiple workers.

Note: the original bug report was examining lack of signal handling
based on the Oslo service code. However, only the engine makes use of
it.

Change-Id: I8519cc6fedf72b38a8ce0762bb86cd70e58e0dc7
Closes-bug: #1276694
Replace marconi by zaqar in heat plugins

Change-Id: I9eb68c27e79782f0da0d9a79bf231e09f2f679bc
Save files while updating a template.

When updating a template object, any updates to the files must also be
saved in the database. With this change, updates to files of a template
are also saved in database.

Change-Id: Ia5b84780158c47ffe807829ce2fc83f4ffbb6db3
Reuse disable_rollback on stack update

If disable_rollback API parameter is not supplied to stack update,
use corresponding value of existing stack.

Change-Id: Iad60e12d31dc3850071dc0b8562c7b99f53adba4
Closes-Bug: #1324366
Only delete stack user project from correct domain

Check the domain ID for the project matches the configured domain from
heat.conf, so we avoid the bad outcome of deleting the user's project
when heat has been configured for stack domain users after creating
some stacks.

Change-Id: I247e732033f44daf0de5b0efeff6c263814d13ab
Closes-Bug: #1365332
Clarify NotFound error when creating trust

If a user creates a stack without the heat_stack_owner role, we
try to create the trust and then fail somewhat cryptically by
letting the NotFound exception from keystoneclient get exposed to
the user.  This is confusing, as it doesn't even mention the role
name (only the ID).

Instead, we can catch the NotFound and propagate a MissingCredential
error, with a list of the role names we need to create the trust.

This error is already correctly mapped to a bad request in the native
API, but not in the CFN exception map, so add it there to avoid 500
errors if this happens via heat-api-cfn.

Now, if a user lacks the required role, they will see an error like:

Missing required credential: roles ['heat_stack_owner']

Which is hopefully somewhat clearer.

Change-Id: Ief4956bdb76ddf0cdb0a642721b63c63b0d007d8
Closes-Bug: #1306665
Use action_handler_task for delete_snapshot

Change-Id: Ic63d466ab325c801f43b5bdcb130870845dd1c34
Add user data and config drive properties

Added these missing properties and upgraded the client
library requirements to support them. This upgrade breaks
Swift compatability, but we don't need to override that
client any more anyway, so client registration for
Swift-via-pyrax is also removed.

Change-Id: I8e07092adf58da2a39330789fb170986176f47e3
Closes-Bug: 1336498
Tests update FakeKeystoneClient to align user_id and trustor

When creating the dummy trust context, we return an arbitrary
hard-coded trustor_user_id, which makes testing we do things
with the trustor correctly difficult, so instead return the
user_id passed into the client (as this is what the trustor id
will be when real create_trust_context calls happen)

Change-Id: I280b820977bfc533126fe392e002210a996311f0
Cleanup trust on delete with stored context if needed

On delete, it's possible that someone other than the user who
created the stack may do the delete, e.g if there are a group
of heat users in a project who share responsibility for stacks.

Currently this causes an error if the user is not an admin,
because keystone default policy means only the trustor user (e.g
the user who originally delegated to heat via the trust on create)
or an admin may delete the trust.

So we check if the context user_id matches the user_creds trustor,
and if it doesn't we switch to the stored context to do the trust
cleanup so we avoid the delete failure.

I've avoided switching to the stored context unconditionally because
of the non-trivial overhead of creating a new keystoneclient object,
getting a new trust-scoped token etc.

Closes-Bug: #1308834
Change-Id: If408534ac7164e9d281dfbb6d4d39da97992f322
Fix so that CSV as str return value

Closes-Bug: #1367393

Change-Id: I0e40b51482d62b94baab1187ddcc38e4aa2d854d
Log translation hint for Heat.api

Currently, Log translation is motivated by oslo's move to prioritized
translation of strings, as documented at
https://wiki.openstack.org/wiki/LoggingStandards#Log_Translation

- add log translation hints for warning, error and info levels
- move from LOG.warning to LOG.warn
- remove use of % as a string formatter, use the log functionality
  instead

Partial implements blueprint log-translation-hints

Change-Id: Ie17871f42f75085c2ac6a14fb1526df7bc3a9603
Fix file mode, remove executable bit.

Fix file permission mode which was improperly set to 0755.  Also some
minor tweakings to the comments in code.

Change-Id: I6ca2aefeab6710cdc83c3273843cb555065078e9
Fix AWS::EC2::VPC resource delete failure

Check resource_id is not None before deleting the resource.

Change-Id: Ib8e8de5badc54c79cee248a9fcc86ebc50397b00
Closes-bug: #1365924
Don't delete stack domain project on stack-abandon

Currently we delete the stack domain project on abandon, which will
break any resources being abandoned that depend on users created in
the stack user domain.  So add a flag to skip deletion on abandon
and some tests to prove it works.

Change-Id: I883831a33d5bd326523836247683c161f797ee2a
Closes-Bug: #1300734
Allow filtering of stacks by username, tenant and owner_id

Adding username, tenant and owner_id to stacks filtering whitelist.

Change-Id: I7471743adcdbed6d70e1a808bf2430e40fa4075e
Closes-Bug: #1367439
Convert functions into a fixed part of the template

http://www.mail-archive.com/openstack-dev@lists.openstack.org/msg28987.html
part of blueprint stevedore-plugins
Change-Id: Iabfa077077fa2170f5da8e7752e05e00db91a692
Make str(json_param) return string vs python

Closes-Bug: #1366798

Change-Id: I3f435932787662cb1bfa91bd5a84c21cf6ddf9d0
Add heat-keystone-setup-domain to sphinx conf.py

The man page for heat-keystone-setup-domain was not being generated
because it was not included in the sphinx conf.py.

Change-Id: Ic1c2025fc7f61e3c37906b42bd84e1df893920fc
Set the default state of a stack to CREATE_IN_PROGRESS

A stacks status is empty when originally entered into the database.
This leads to returning empty status responses back if the engine is
pre-occupied with other tasks.

This patch sets a stack's status to CREATE_IN_PROGRESS by default when
the stack object is created.

The stack object is only ever created during create and preview and is
loaded otherwise from the database in all the other scenarios.

Change-Id: Iab0892896b398530423bbe6c6a623376bf86590e
Closes-Bug: #1365399