Server secgroups and network/port together invalid

Nova silently ignores security_groups properties for a server if the
server has a 'networks' property that references a neutron port, the
intent being that security groups are assigned to the port(s).

Adds note to Server properties to this effect.
Validation fails for a Server if 'security_groups' is defined AND
the server has neutron Ports assigned.

Change-Id: I883761a0bb0e73a3fcc7c362d8e6dc5a099806e0
Closes-Bug: #1270313
Native ScalingPolicy resource

Implement a native scaling policy resource providing the same interface
as the AWS one.

blueprint as-intermediate-resources
Co-Authored-By: cedric.soulas@cloudwatt.com
Change-Id: I1f51e7fbdd4816842ceefeeee1a804e0fc671c45
Allow proper instance with volume suspension

When suspending a stack that contains an instance with a volume
attached through the instance's "Volumes" property, the stack will
go into a SUSPEND_COMPLETE state, but the actual instance will still
be in an ACTIVE state. This is because check_suspend_complete will
return TRUE without ever starting the instance's suspend task.
This commit ensures that the instance suspension TaskRunner is
actually started.

Change-Id: I77291d21b291242684cf42e7143b264521ba113e
Closes-Bug: #1284306
Return None when get_attr cannot resolve a value

To prevent validation failures prior to resource creation, get_attr
returns None if the attribute or the sub-value cannot be resolved.
This returns this function to consistency with prior behavior and allows
non-string attribute values to be resolved to their proper default
"empty" data types during initial template validation.

Change-Id: I0e02174c43be65a647358a2047da8213635f85d8
Closes-Bug: 1287397
Nova server to ref cloud-config resources in user_data

With this change it is now possible to do boot-time cloud-init configuration
using some combination of OS::Heat::MultipartMime, OS::Heat::CloudConfig or
OS::Heat::SoftwareConfig.

Cloud-init configuration is specified by referencing the resource
in the user_data when user_data_format=RAW:

  server:
    type: OS::Nova::Server
    properties:
      ...
      user_data_format: RAW
      user_data:
        get_resource: server_init

Alternatively, the config can be fetched as a string attribute
from the OS::Heat::SoftwareConfig config attribute:

  server:
    type: OS::Nova::Server
    properties:
      ...
      user_data_format: RAW
      user_data:
        get_attr: [server_init, config]

implements blueprint cloud-init-resource
Change-Id: I72f74d302afd71dac3845282dcc9a1ca83e92149
Allow getting attributes on suspended resources.

A resource which is suspended can legitimately have attributes returned
for it.

Related-Bug: #1286920

Change-Id: I350b2e20e274cce7a0f654cb71f7445632e0e633
Allow handle_signal to assert which actions are valid

This retains the current behaviour for InstanceGroup and Restarter
while allowing other resources to apply different policies about
what actions are allowed when a signal is received. This is needed
by SoftwareDeployment, which can legitimately receive signals
during SUSPEND and DELETE.

Change-Id: I6f694451669b6c9b60b9fbd3ad77d0fc111bbb5a
Closes-Bug: #1286920
Add tools/create_heat_domain helper script

For users who don't yet have python-openstackclient, or who require
a more automated way of creating the heat domain and domain-admin
user, provide a simple wrapper for the keystoneclient python API
which will create the domain and user, then print a helpful cut/paste
message to allow heat.conf to be easily updated.

It requires a cloud-admin users credentials to be sourced in the
environment, OS_USERNAME/OS_PASSWORD/OS_AUTH_URL and also a script
specific variable HEAT_DOMAIN_PASSWORD which specifies the password
for the domain-admin user.  Other values may be overridden by the
environment but default to sane values.

Change-Id: I5731ba72491dcf515c5d230b55056d9263341c54
Partial-Bug: #1287980
Use PluginManager to load resources

Change-Id: If682ca26f9d214a4cfc1b86baa29f87242373f04
Load functions from plugins

Implements blueprint function-plugins

Change-Id: Iad13fd25e3697e3462753dc53ae25418969da8a5
Move HOT parameters code to a separate module

Change-Id: If9755cf20c9f78cf1c93ac571ec1d4b3fdc320dc
Merge "Nova server to ref cloud-config resources in user_data"
Fixup uuid stubbing in test_stack_user.py

As noted in https://review.openstack.org/#/c/71930/13  there is an issue
with using the utils.UUIDStub method to stub the resource ID, because
any events stored also get the same uuid, which can cause sqlalchemy
warnings to be output.  Instead store the resource before setting up the
keystoneclient stub so we know the expected ID to use.

Change-Id: Ia456425384d52b3983b8d1d387f56e57e8b559ee
heat_keystoneclient add legacy fallback path

If users fail to observe the reccomendations in the commit messages
and/or release notes and use a heat.conf from a previous version of
heat currently some functionality will fail due to the missing
domain configuration in heat.conf.  Instead degrade gracefully with
warnings, calling the non-domain functions which are maintained
(for now) for backwards compatibility.

Hopefully we won't have to maintain this huge pile of legacy stuff
for too long :(

Change-Id: Ia029d585dfdb2563609725589c41083819a11a3b
Closes-Bug: #1287980
heat_keystoneclient add delete_stack_domain_user_keypair

Adds function to delete a credential containing a keypair, since we
do this as admin we also sanity check to ensure the user associated
is a stack domain user, if not we should fall back to the non-admin
path

Change-Id: Ie15958f91b6b80b4a3f0b73943345b7d27566077
blueprint: instance-users
StackUser add suspend/resume support

Adds suspend resume support which will be required to migrate the
User resource to this base class without losing functionality

Change-Id: I3607ef71bfcd863b08879b3856baa92e7aeeef10
blueprint: instance-users
Add test for StackUser._create_keypair

Currently _create_keypair is only indirectly tested via SignalResponder
so add a base-class-specific test.

Change-Id: Ic9f1df06df25205f864b2f0138d2821089608b88
blueprint: instance-users
Allows vip from a different subnet for lbaas resource

This fix allows user to specify a different subnet while adding
a vip to a pool resource. If vip subnet is not provided, pool
subnet is used by default.

Change-Id: I0b7740ca37961ae412866cc15ab439dafbfcf9d9
Closes-Bug: #1286001
Merge "Native ScalingPolicy resource"
Merge "Add tools/create_heat_domain helper script"