Revert object-assuming changes to _post_live_migration()

Change I140bfec2a52bf659a725a7dbe78ba5c527ed26de converted the
_post_live_migration() call to assume it was passed an object
because the post_live_migration_at_destination() method uses them.
However, it is also called from live_migration() on the source,
which clearly is still using instance dicts.

This patch reverts the changes that assume an instance object,
as well as the tests that were changed as a result. It also
changes the clear_events_for_instance() call to use dict syntax,
since that is called from the live migration path currently.

(cherry picked from commit 887d214186631d3d1f49451fa72feb11251d2176)
Change-Id: I6e915035bc2c1b890e606d17a4195b88c3f26b13
Closes-bug: #1302334
libvirt: pause mode is not supported by all drivers

Only KVM/Qemu drivers support the VIR_DOMAIN_START_PAUSED flag
Booting guests on other drivers with the above flag will make it fail.

Closes-Bug: 1301453
Change-Id: Ia98e018b686c4ec3c15fd1f6bcc78188f330fcef
(cherry picked from commit bfb28fcf9031af4c695177663702ce05edbbfa4d)
Note that XML support *may* be removed.

To be more accurate, note that XML support *may* be removed as early
as the Juno release.  I think there is still more discussion needed
around concrete usage data before the removal date is finalized.

Related thread:
http://lists.openstack.org/pipermail/openstack-dev/2014-April/031608.html

Closes-bug: #1301384
Change-Id: I0415b50ec0b81bb56f5c0fa13bc6d01f8bec7865
(cherry picked from commit 5d39189df6ecb559c3f8b7e2fa3beff25da9f452)
Ensure network interfaces are in requested order

_build_network_info_model was iterating current_neutron_ports
instead of port_ids which contains ports in their correctly requested
order. Because of this the requested nic order was no longer being
perserved. This patch fixes this and also changes the order of ports
in test_build_network_info_model() so this case is tested.

Change-Id: Ia9e71364bca6cbc24ebc1c234e6a5af14f51cd62
Closes-bug: #1300325
(cherry picked from commit 721e7f939859fbfe6b0c79ef3a6d5e43c916da65)
mark vif_driver as deprecated and log warning

Several classes were dropped from nova.virt.libvirt.vif from havana ->
icehouse, leading to invalid configurations if one of these classes was
used in the libvirt_vif_driver setting in nova.conf.  The error message
produced by nova-compute in this situation is misleading.

This patch introduces stubs for all of the classes that were removed.
These stubs inherit from LibvirtGenericVIFDriver and log a deprecation
warning in __init__.

This patch also marks the vif_driver option as deprecated.

Change-Id: I6d6cb9315ce6f3b33d17756bcdc77dccda26fefe
Closed-bug: 1302796
(cherry picked from commit 9f6070e194504cc2ca2b7f2a2aabbf91c6b81897)
VMware: Fixes the instance resize problem

The fix includes separating out methods for
associating/disassociating a vsphere vm from the
openstack instance. Modifying the resize workflow
to use the above mentioned methods.

Closes-Bug: #1295381

Change-Id: I92acdd5cd00f739d504738413d3b63a2e17f2866
(cherry picked from commit 91ddf85abb8a516cfa2da346b393aa7234660f6c)
Merge "Note that XML support *may* be removed." into milestone-proposed
Merge "VMware: Fixes the instance resize problem" into milestone-proposed
Require admin context for interfaces on ext network

Currently any user can attach an interface to a neutron
external network, if the neutron plugin supports the port
binding extension.
In this case, nova will create neutron ports using the admin
client, thus bypassing neutron authZ checks for creating ports
on external networks.

This patch adds a check in nova to verify the API request has an
admin context when a request for an interface is made on a
neutron external network.

Change-Id: I5fb0bdcbf19eb82746ea3b192c1f65899bfb3c0b
Closes-Bug: 1284718
(cherry picked from commit 7d1b4117fda7709307a35e56625cfa7709a6b795)
Merge "mark vif_driver as deprecated and log warning" into milestone-proposed
Merge "Ensure network interfaces are in requested order" into milestone-proposed
Merge "Require admin context for interfaces on ext network" into milestone-proposed
Fix Jenkins translation jobs

The -propose-translation-update and -upstream-translation-update
jobs do not update from transifex since our po files contain
duplicate entries where obsolete entries duplicate normal entries.

Remove all obsolete entries to fix the jobs.

Change-Id: Ia174a145e71ab6c2bfd99f06e8ebead2e91e15ea
Closes-Bug: #1299349
Enable ServerGroup scheduler filters by default

The Icehouse release includes a server group REST API. For these
groups to actually function properly, the server group scheduler
filters must be enabled. So, these filters should be enabled by
default since the API is also enabled by default. If the API is not
used, the scheduler filters will be a no-op.

DocImpact
Change-Id: Ia52d7fcfff52377d8beae2acd9b7eba9c6c74e09
Closes-bug: #1303983
(cherry picked from commit 7b8402ed3ba734836119441bdf1a6d6c661c8df2)
Fix anti-affinity server-group boot failure

When the second instance is booted to an anti-affinity group
the scheduler fails with an exception due to a missing type conversion.

Closes-Bug: #1301982
Change-Id: I87b2a8d8c7d04b781c789374d6e9c7f4c8567e5d
(cherry picked from commit 1680cf8cef9bd670306a0ef74803409f60f21f28)
Merge "Fix anti-affinity server-group boot failure" into milestone-proposed
Update docs to reflect new default filters

Server group scheduler filters were added to the default set of
scheduler filters.  Update the docs to reflect the updated defaults.

Change-Id: I614cf83e419c93038fc4ed7287ec743cedb4860e
Related-bug: #1303983
(cherry picked from commit 71661a9c05c846ce109b72706bba2087cb0b02a5)
Fix straggling uses of direct-to-database queries in nova-network

There were a few remaining calls directly to the database module
left in nova-network. These would fail because of the wedge we
put in place specifically to catch this case. However, we don't
test VlanManager in the gate, which means we didn't catch them
until now.

This required adding two more methods, one each to Network and
NetworkList, but they are both extremely simple.

Change-Id: Iecc382074f060da1bd6f740d7bde0b20a0be2fcf
Closes-bug: #1304724
(cherry picked from commit 275a165cf0e74112d7ec9addacb1f84d703977c8)
Merge "Update docs to reflect new default filters" into milestone-proposed
Add RBAC policy for ec2 API security groups calls

The revoke_security_group_ingress, revoke_security_group_ingress, and
delete_security_group calls in the ec2 API were not restricted by policy
checks.  This prevented a deployer from restricting their usage via
roles or other checks.  Checks have been added for these calls.

Closes-Bug: #1290537
Change-Id: I4bf681bedd68ed2216b429d34db735823e0a6189
(cherry picked from commit d4056f8723cc6cefb28ff6e5a7c0df5ea77f82ef)