Run django-admin collectstatic for horizon

If other apps are installed alongside Horizon, we need to collect
all of the static artifacts, such as CSS and JS -- which Django has
support for, so make use of it.

As a consequence, set Horizon's ROOT_ROOT to a well-known path, and
create it if needed in install.d.

Change-Id: Icb2f511734ab882dda0b7d00ab73bd6b3cb961f7
Closes-Bug: #1363298
Allow custom root labels

Makes the localboot element aware of the custom root fs labels
added in I596104d1a63b5dc6549e8460a1ae3da00165ef04 for
diskimage-builder.  That change must merge before this one.

Change-Id: Ic89379eca8699b27a4b89de9da3fc4f56011963e
Hash instance-id instead of expecting specific format

In versions of cloud-init prior to 0.7.5,
/var/lib/cloud/data/instance-id was something of the form
i-########.  Our mysql-common element used that ######## bit to set
the mysqld server_id.

In cloud-init 0.7.5, and probably above, the instance-id file is a
uuid instead, which means there is no numeric part for us to use as
the server_id.

To address this, I'm hashing the instance-id and using that
value instead of one pulled from the id itself, which should work
for arbitrary formats of the id.  There is some tiny chance of
hash collisions with this method, but the server_id will allow
2 ^ 32 - 1 different values, so the odds of that happening are
extremely small.

Change-Id: Ia43742bb776ea93b6ed281161c3d362f5b803171
SELinux: Allow swift access to ephemeral ports

Enable the swift_can_network SELinux boolean to allow
swift access to ephemeral ports.

Change-Id: Ib7289929093f03ad39bb0aaa8e75f7e0842a9f5f
Closes-Bug: 1375526
Add package install support

Adds package install support for tripleo-heat-templates, which is a
dependency of Tuskar, thus it needs to be installed on underclouds.

Change-Id: I81b1308b0122763d396328458fc129072cce8198
RHEL SELinux custom policy for neutron-ns-meta

neutron-ns-meta is denied connectto on unix_stream_socket on RHEL.

Fedora selinux-policy has the correct fix. That fix needs to be
applied to RHEL. We need this custom policy until it is applied.

Partial-Bug: 1375534

Change-Id: I9f3932f88c5796755fefaeedea9811b82b291635
Custom SELinux policy for rhsmcertd

Policy update to fix rhsmcertd denials on RHEL. This is needed
until the RHEL selinux-policy package is updated.

Change-Id: Ief542a442b8206ad59c1aa055307df213597b532
Partial-Bug: 1375532
SELinux: allow openssl access to /run/keystone

On RHEL, openssl is being denied access to /run/keystone. This issue
was fixed on Fedora and that fix needs to be merged into the RHEL
selinux-policy package. In the meantime, this custom policy is needed.

Change-Id: I93c85ed883fc5f6f05ff37bb8f05eee0e53f1b78
Related-Bug: 1376038
Install static element files

Several elements want to install static files. Some do this using the
"os-apply-config" directory, which means these files are unnecessarily
rewritten every time os-refresh-config triggers. Others put files in a
"files" dir and manually script the installation from an install.d
script.

This patch offers a more convenient "static" directory. Files placed in
here will be rsynced into the image.

Change-Id: I61276a1fc71f0bdfd90134b000100e5e64b1ff75
Merge "Run django-admin collectstatic for horizon"
Keystone LDAP domain configuration

Generate domain specific configuration file
/etc/keystone/domains/keystone.ldap.conf. Please refer to keystone
element README.md file for configuration example.

Change-Id: I627766c7b2948bd4c4955772e46b5b3e41779248
Fix DISTRO_NAME usage for centos7 element

In each of the changed files in this patch, the $DISTRO_NAME usage
is checking against "centos".  The valid value for the centos7
element for $DISTRO_NAME is "centos7"[1].

[1] http://git.io/8IvuTw

Change-Id: I5d59e195c38fc7ff5b3235e195171fafcf5b4f87
Ensure correct permissions for /var/lib/mysql when dir is recreated

Change-Id: Ieff239611292785c728bfbc367a7facf948d628b
Add initial svc-map support

This patch incorporates the svc-map patch[1] into other
elements by integrating svc-map into the os-svc-install
element.  This patch adds the -a option to select svc-map
instead of the default of map-services.  The -a option
enables a phased transition from map-services to svc-map
usage throughout the rest of the elements.

[1] Id11433ea342aace71a358936a7ca3151ec11d506

Change-Id: I382631746e458f2f8603a7dcf5221a21f4b53255
Fix heat purge deleted cron job

The cron job was sending errors to root's mailbox. Errors are
now directed to syslog.

The job couldn't find heat-manage. Added PATH and included
/usr/local/bin where heat-manage is located.

Change-Id: I31f28ac741731018d5be7943d0a336c99a909562
Closes-Bug: 1369755
haproxy global maxconn is less than default maxconn

The current global maxconn is hard-coded to 4000 and the default
per-service maxconn is 8000. As a result we have a potential
denial of service attack with a single service using up the
global limit.

This patch makes the global maxconn and the per-service maxconn
configurable. The default global maxconn is left at 4000 and the
default value for the default per-service maxconn is set to a much
lower value. With this change, both per-service default and
individual service maxconn settings are configurable.

Note the default per-service level setting of 150 was chosen on the
basis of haproxy handling 20 services, leading to 200 connections
per service. A value lower than 200 was chosen to allow wriggle room
for specific service maxconn levels to be set higher than others.

Change-Id: I0f1c6bd47f25fb8839c6ebc7fd5f1afb3fabd986
Merge "Install static element files"
Merge "Keystone LDAP domain configuration"
Revert "Install static element files"

Needs more thought about how to ensure files are owned by the correct user. The only way which occurs to me is a manifest file and I'm not sure that fits within the "convenience budget" compared to installing files with install.d scripts.

This reverts commit 00b7e98af1e8b7f14895736e4df079757624948e.

Change-Id: Iebda1df225471b45b17f922b9e3c2e2d487bdffb
Merge "Revert "Install static element files""