Add tarball comparison logic

This patch adds support for a very simple
update mechanism. Tarballs are downloaded,
md5 sums checked for changes from the current
one, and if they are different the new tarball
is extracted in place of the old one.

Change-Id: Ie23efc9795ba6520bb108d6797bb52651e44e273
Add network namespace support

RedHat kernels do not have network namespaces
enabled by default. This patch uses the netns class
in openstacklib to check if network namespaces are
available, and if they are not, install the latest kernel.

Ubuntu hosts are unaffected, and should contain netns support
in all common cases anyway.

Change-Id: Ided02a7bfe57ab3e318c7ac24df0eeb54b349c08
Add fqdn check to bootstrap script

This patch prevents the hosts file from
being overwritten if the fqdn fact is already
returning $hostname.$domain_name. This allows
A site that does not want the installer to manage
its hosts file to work cleanly.

Change-Id: I18c8a151aa98b979bc94caabad57680ed3b34570
Merge "Add fqdn check to bootstrap script"
Merge "Add network namespace support"
Merge "Add tarball comparison logic"
Push stacktira scenario to icehouse

This patch moves stacktira to the icehouse release
and contains a couple of other minor fixes for the
stacktira scenario:

the default mirror has changed due to stability issues

services are being gradually moved to bind only to the
internal interface, and haproxy will forward traffic

notifications support has been added

the firewall on the internal interface between control
and compute has been opened to allow all traffic for VMs

Accommodate some changes in openstacklib structure

Add ML2 support.

Change-Id: I23fb8048f0e0463d8c16998b5bfa8c797a295445
Improved firewall support

Add support for new firewalling in openstacklib (soon
to be moved to openstack_extras) that manages SSH and
other basic rules, along with improved dashboard
firewall management.

Change-Id: Ib95254fd98e19111463e7b0c4c2e38d89f7b83da
Remove heat endpoints from class group

Endpoints are managed for all other services via
coi::profiles::endpoints. Heat currently isn't
because its class structure doesn't match, which
is due to it having a separate class for the
cloudformation endpoint.

This patch should be paired with a patch to puppet-coi
and any other consumers of enabled_services to handle
this special case.

Change-Id: I9bbb1c59cbebc8962bdd34c890e0af1f1a4be469
Add horizon mappings

Horizon will by default use the fqdn of the controller
node. This is not correct in the case where the fqdn
being used is from a non-public interface, or for the
case where a virtual IP sits in front of the dashboard
and has its own name.

This patch uses controller_public_address for the horizon
fqdn and servername.

Change-Id: I75a00c0f1b9a265a8c103109971b018def903196
Add ML2 support

Two new class groups have been added that enable the ml2
folder structure, and include extra classes on compute nodes
that were not previously required. Scenarios should swap over
to these class groups when they are ready.

core_plugin for neutron was previously set by plugin
choice, it is now set to ml2 in user.common.yaml. To use
the deprecated plugins this will need to be overridden
manually by the user. Mechanisms are set by plugin choice,
but there is currently only support for a single mechanism
at a time.

This patch focuses solely on gre support. VXLAN and others can
be added in future patches.

The service_plugins format has been changed to a curated list of
strings, and has been reduced to only include the router plugin
while support for other plugins is tested.

Change-Id: I258074d70bf136ac4d8eaf08abc06e8676db3829
Add SSL termination on all public endpoints

This patch adds SSL support to the Stacktira scenario as
a new default.

 - Sample cert and ca has been added to the build directory,
 and it will be inserted into all VMs so that they can communicate
 without using --insecure. The script for generating more has also
 been added.

 - Regions code has been moved away from the endpoints wrapper and
 into the full multi-regions class, with the default only making
 a single region.

 - controller_internal_protocol and controller_admin_protocol have been
 added to clearly delineate between public SSL services and internal
 services which remain at this time HTTP only. These have been added to
 the common defaults and mappings updated accordingly

 - ssl_bind_options can be used to change the options for the HAProxy
 listen stanze responsible for binding public SSL services

 - the cert path can be specified using haproxy_cert_path. It is assumed
 the cert is pre-distributed on the node.

 - The SSL termination happens at the HAProxy layer, so support for this
 is currently limited to scenarios that use HAProxy via openstacklib

Change-Id: I36fcf894e3e17d8ddc50ea1ea0abce1b421cfdba
Minor fixes to stacktira scenario

Fixes for Icehouse release:

 - update gitignore for user data, rpm and gem dirs

 - remove contrib path from hiera

 - add branch release support to Puppetfile

 - correct loose facts handling in bootstrap

 - Clean unused sections from site.pp and tidy output

 - move options out of user.stacktira and into user.yaml

 - move defaults out of user.yaml and into user.stacktira

 - add more mappings comments

 - add mappings for bind interfaces

 - add mappings for master/slave galera

 - add mappings for proxy

 - move passwords to user.yaml

 - add anchors and mapping for memcached and heat::rabbit_hosts

 - add a testing script that works with test_nova.sh

 - remove galera::firewall from class group due to parse order errors

 - add mapping for vnc proxyclient on private ip

 - move glance registry comms to private interface

 - add mappings for openstack_release into repo mgmt

 - remove edeploy and dnsmasq

 - set lbaas user to nobody instead of nogroup

 - increase max_connections in galera

 - enable vpnaas, lbaas and fwaas in neutron

 - reduce default worker count to 4

 - add converged scenario combining control and compute

Change-Id: I6a1d131a8efa55a141895adc01ba12c547e9686c
Add ceilometer to stacktira

This patch adds the ceilometer_control
group to the stacktira controller.

The ceilometer::keystone::auth class is already
included in COI via enabled_services and is not
needed in stacktira due to regions_hash.

A singleton class is used to prevent multiple
central agents from running.

The keystone admin and public endpoints had to be
changed as the ceilometer client was adding
extra versioning to the path. This matches
the behavior in the comments and does not
seem to affect any other clients.

Change-Id: Ifd705c5efebcce8d80d40066139da284800d1fc7
Move keepalived to external bridge by default

When using l3 agent, keepalived needs to be running
on br-ex instead of the ethernet interface in order
to function.

Change-Id: Iec84834c7c5bda94048829c2b6257518b1d06578
Bump puppet version to 3.6.2

This allows use of puppet-partial for image builds,
and the use of ensure on yumrepos.

Change-Id: Ia45d1655aed699f4021a5b332c5918aac2a2f90f
Add ceilometer to converged role

Change-Id: Ia45f980c63c9421a0bacdd525be30f548f05dc6b
Map controller_public_protocol to vncproxy

Change-Id: I6f296f4004b43f738d7283545e8f4a0096ed56be
Remove override of compute firewall interface

This is already done through a mapping and isn't needed

Change-Id: I783d461a0ccdd0c8f07467658e20f4564885ecc7
Move keystone public to controller_public.

It was previously mapped to internal.

Change-Id: I3f756a5174eb6ae642ca9cc0877fa65f13b606ad