Work around keepalived split brain

When a host reboots, it's possible for keepalived to come up whilst
the host's network is still being reconfigured (which happens
asynchronously). This can cause the netfilter it puts in place to
fail to see announcements from other members of the cluster,
convincing it to bring up the VIP when it already exists on another
host.

The approach here is crude: every five minutes we cause a reload of
keepalived's configuration, which has the side-effect of making it
reappraise its netfilters and regenerate them.

This is a stopgap measure whilst the underlying causes are bottomed
out.

Change-Id: Ic0397d79465869b78a72faef8653aedee321a3e2
Partial-fix: 1367742
Allow custom root labels

Makes the localboot element aware of the custom root fs labels
added in I596104d1a63b5dc6549e8460a1ae3da00165ef04 for
diskimage-builder.  That change must merge before this one.

Change-Id: Ic89379eca8699b27a4b89de9da3fc4f56011963e
Hash instance-id instead of expecting specific format

In versions of cloud-init prior to 0.7.5,
/var/lib/cloud/data/instance-id was something of the form
i-########.  Our mysql-common element used that ######## bit to set
the mysqld server_id.

In cloud-init 0.7.5, and probably above, the instance-id file is a
uuid instead, which means there is no numeric part for us to use as
the server_id.

To address this, I'm hashing the instance-id and using that
value instead of one pulled from the id itself, which should work
for arbitrary formats of the id.  There is some tiny chance of
hash collisions with this method, but the server_id will allow
2 ^ 32 - 1 different values, so the odds of that happening are
extremely small.

Change-Id: Ia43742bb776ea93b6ed281161c3d362f5b803171
Replace ensure-bridge w/ os-net-config.

This updates the init-neutron-ovs script so that it
dynamically writes out an os-net-config config file
and then runs os-net-config to perform the required
network configuration.

Change-Id: I5f51ecb5c64fc9c13eabc16b2b43b5dda1b38d65
Handle double path registration

Canonicalise paths from /var/lib/use-ephemeral/stateful-paths and only
copy files from a path once.

This means that if path /a is registered twice, you don't end up with
/mnt/state/a/a.

Note: symlinks must be relative for this to work. Rewriting absolute
symlinks can be a follow-on patch.

Example (hacked slightly to work as if boo was root):

  $ tree boo
  boo
  └── var
      └── lib
          └── use-ephemeral
              ├── a
              ├── b -> a
              └── stateful-paths

  $ tree boo
  boo
  ├── mnt
  │   └── state
  │       ├── a
  │       └── b -> a
  └── var
      └── lib
          └── use-ephemeral
              ├── a
              ├── b -> a
              └── stateful-paths

Change-Id: I60eb87f44b8b8d122cb4af472327d390e8ba4c23
Co-Author: alexisl@hp.com
Symlink to backup dir until ephemeral storage available

Currently, when you call `register-state-path --leave-symlink /a`, a
symlink is left at /a pointing to /mnt/state/a. However, /mnt/state
doesn't point at ephemeral storage until the instance has booted. So if
another element tries to write through the symlink, it goes wrong.

This patch defers moving content (and leaving a symlink if required) to the
backup dir until finalise.d runs.

Change-Id: Id5bc25965db1fdf27f2bcb947c518f6f4566fd2f
Co-Author: Nicholas Randon
Make sure that keystonemiddleware package is installed

With I58dad8e1151067bf8df37e511fff5fc0e3dfb487 we switched from
obsolete keystoneclient to keystonemiddleware, make sure that proper
package is installed too.

Change-Id: Ifee489dbb52d4ae401d010d34ca5e244ea3e08e3
SELinux: Allow swift access to ephemeral ports

Enable the swift_can_network SELinux boolean to allow
swift access to ephemeral ports.

Change-Id: Ib7289929093f03ad39bb0aaa8e75f7e0842a9f5f
Closes-Bug: 1375526
Add package install support

Adds package install support for tripleo-heat-templates, which is a
dependency of Tuskar, thus it needs to be installed on underclouds.

Change-Id: I81b1308b0122763d396328458fc129072cce8198
RHEL SELinux custom policy for neutron-ns-meta

neutron-ns-meta is denied connectto on unix_stream_socket on RHEL.

Fedora selinux-policy has the correct fix. That fix needs to be
applied to RHEL. We need this custom policy until it is applied.

Partial-Bug: 1375534

Change-Id: I9f3932f88c5796755fefaeedea9811b82b291635
Correct slo middleware position swift proxy-server pipeline

The recommended position for SLO middleware has changed
in Swift (see change ID I7827dd2d9dfbb3c6424773fb2891355d47e372ba).
This change updates the swift proxy-server pipeline to move SLO
middleware to the correct position.

Related-Bug: #1315133
Change-Id: If52935ec7986adec67bb190a4509c8a8c35056c9
Custom SELinux policy for rhsmcertd

Policy update to fix rhsmcertd denials on RHEL. This is needed
until the RHEL selinux-policy package is updated.

Change-Id: Ief542a442b8206ad59c1aa055307df213597b532
Partial-Bug: 1375532
ensure that port is added to bridge after a reboot

This is a change to the interfaces file to allow
openvswitch to start the ovs-bridge and to add the
specified ports.  Without this change, the bridge
comes up after a reboot of the seed or undercloud,
but the port associated with the physical interface
doesn't come up.

Change-Id: Ic968f39b16934c9e55d9aa448cbd9de54f659d4d
Closes-Bug: 1373063
Co-Authored-By: Ashok kumaran B<ashokkumaran.b@hp.com>
SELinux: allow openssl access to /run/keystone

On RHEL, openssl is being denied access to /run/keystone. This issue
was fixed on Fedora and that fix needs to be merged into the RHEL
selinux-policy package. In the meantime, this custom policy is needed.

Change-Id: I93c85ed883fc5f6f05ff37bb8f05eee0e53f1b78
Related-Bug: 1376038
Install static element files

Several elements want to install static files. Some do this using the
"os-apply-config" directory, which means these files are unnecessarily
rewritten every time os-refresh-config triggers. Others put files in a
"files" dir and manually script the installation from an install.d
script.

This patch offers a more convenient "static" directory. Files placed in
here will be rsynced into the image.

Change-Id: I61276a1fc71f0bdfd90134b000100e5e64b1ff75
Keystone LDAP domain configuration

Generate domain specific configuration file
/etc/keystone/domains/keystone.ldap.conf. Please refer to keystone
element README.md file for configuration example.

Change-Id: I627766c7b2948bd4c4955772e46b5b3e41779248
Fix DISTRO_NAME usage for centos7 element

In each of the changed files in this patch, the $DISTRO_NAME usage
is checking against "centos".  The valid value for the centos7
element for $DISTRO_NAME is "centos7"[1].

[1] http://git.io/8IvuTw

Change-Id: I5d59e195c38fc7ff5b3235e195171fafcf5b4f87
Ensure correct permissions for /var/lib/mysql when dir is recreated

Change-Id: Ieff239611292785c728bfbc367a7facf948d628b
Add initial svc-map support

This patch incorporates the svc-map patch[1] into other
elements by integrating svc-map into the os-svc-install
element.  This patch adds the -a option to select svc-map
instead of the default of map-services.  The -a option
enables a phased transition from map-services to svc-map
usage throughout the rest of the elements.

[1] Id11433ea342aace71a358936a7ca3151ec11d506

Change-Id: I382631746e458f2f8603a7dcf5221a21f4b53255
Fix heat purge deleted cron job

The cron job was sending errors to root's mailbox. Errors are
now directed to syslog.

The job couldn't find heat-manage. Added PATH and included
/usr/local/bin where heat-manage is located.

Change-Id: I31f28ac741731018d5be7943d0a336c99a909562
Closes-Bug: 1369755