Set the volume access mode during volume attach

cinderclient supports an optional keyword argument named 'mode'
for volumes.attach(), which allows you to set the access mode of
a volume at attach time. The keyword argument is not passed in
by nova when it attaches a read-only volume, making the volume
access mode default to 'rw' instead of the desired 'ro'. This
patch finds the access mode of the volume and passes it to
cinderclient, so the correct access mode is used at attach
time.

Change-Id: Ib62f454292e60114f96debbad96c4a356dc32a21
Closes-Bug: #1307088
(cherry picked from commit de05c2994212e83eba3cedf2544cdc549d9f8184)
Revert "Remove broken quota-classes API"

This reverts commit 7d22153d05c67bb0bf4838efdb17b3360ec2e367.

The quota_classes API was used to set default quota values
so it shouldn't have been removed, so reverting a series
of changes that removed the API and it's internal code.

Related mailing list thread on the topic:

http://lists.openstack.org/pipermail/openstack-dev/2014-May/035383.html

Partial-Bug: #1299517

Conflicts:
	doc/api_samples/all_extensions/extensions-get-resp.json
	doc/api_samples/all_extensions/extensions-get-resp.xml
	nova/tests/integrated/api_samples/all_extensions/extensions-get-resp.xml.tpl

The conflicts are due to Mark McLoughlin's timestamp-format series
of changes on master (Juno).

Also note that quota_classes.py was changed due to
commit c75a15a4 to rename the NotAuthorized exception
to Forbidden.

Change-Id: I7890e6b41d4ebf19944c1d4db65111fcc4c45463
(cherry picked from commit 35338d54ad2f76807011a5b666df434eec5369b2)
Use correct project/user for quotas

This fixes the compute manager to ensure the proper project_id/user_id
is used when making quota calls by converting most of the compute
manager code to use the new objects. This does not change the RPC
messages to the manager, yet.

Change-Id: I50601d12edef735f3c01ad73445e0826d05efc51
Closes-bug: 1271541
(cherry picked from commit 0a717d7085bd2bca7e5408a5c20e8ae7cd055756)
Use no_timer_check with soft-qemu

The Linux kernel timer check not working properly
when the hypervisor's thread preempted by the host CPU scheduler.

The timer check is automatically disabled with other types
of hypervisors including the hardware accelerated kvm,
but timer_check is not disabled when qemu used without hardware acceleration.

This issue is frequently mischaracterized as an SSH connectivity issue and
causes rechecks and occasional boot failures.

This change adds no_timer_check kernel parameter when we are using
uec images with qemu.

Closes-Bug: #1312199
Change-Id: I3cfdfe9048fe219fc12cdac8a399b496f237e55e
(cherry picked from commit 6b86a61fee15ce1237303fab2f7896f8c3bcad47)
Failure during termination should always leave state as error()

Currently we have a situation where if an instance fails to delete,
instead of having its state reverted, like we do in most places we set
it to error,deleting. This was intentionally done in
I5fb1bbd56035792f566a6e076edfe7a69df006ef. We also intentionally ignore
duplicate requests to delete an instance if its already being deleted
(I2f97f93bd714e0ea3b6d4fa3ac457ab43eed00e1). The combination of these two
things means that if an instance fails to delete for some reason a
tenant is unable to delete that instance.

It turns out this is really bad because instances in deleting state
count against quota, so the tenant slowly looses usable quota.

To fix this, upon a failed termination set the vm_state to error and
revert the task_state. This is a partial revert of
I55742203bdd071c7df90902868e46c2020f799bd.

Change-Id: I55742203bdd071c7df90902868e46c2020f799bd
Closes-Bug: #1329559
(cherry picked from commit f33a25a3c40722644c774395b38fd7a7ed0246e1)
Cleanup allocating networks when InstanceNotFound is raised

Allocated networks were not being cleaned up if InstanceNotFound was
raised after the allocation request was made.  This ensures that the
cleanup happens for this case.

Also bypasses exception logging that should not occur in this case.

Conflicts:
	nova/tests/compute/test_compute_mgr.py

NOTE(mriedem): The conflict is due to commit b1994711 which is on
master but not stable/icehouse. It's part of a blueprint so that
will not be backported.

Change-Id: Icd544752444415812714d91971e45b3ae2fb68ee
Closes-Bug: 1324934
(cherry picked from commit 5a364cb00a39b31a9d5ddb30b5cc24af54e89f4a)
Save connection info in libvirt after volume connect

The libvirt driver will connect volumes for BFV while processing
the guest configuration, but not save the connection_info into
the database. This adds a save there to make sure that any
storage driver details get persisted.

Change-Id: Ia99e04ad80a2823a6852debf0919e72b2f93bd26
Related-bug: #1328245
(cherry picked from commit a1a2d0605b555f149846eb7e74f7d1760e55ed75)
Network: ensure that ports are 'unset' when instance is deleted

Commit a141206e9dfd31955b9b31d9e5a7f73bbd8510ca ensured that user defined
ports were not deleted when an instance is deleted or rescheduled. The
problem with this commit is that it did not reset the 'device_id' and
'device_owner' of the port. This leads to port leakage and eventually a tenant
is unable to launch any instances as their port quota has exceeded the
allocated amount.

The solution is for the deallocation to reset the 'device_id' and the
'device_owner' of the port. This is allocated when the port is actually assigned
to an instance.

In the case of minesweeper (which runs on OpenStack), the tenant was leaking ports.
The root cause was that the user defined ports were assigned to a specific instance,
which was deleted, as a result of a failed reschedule (which is legitimate).

When an instance is deleted all artificats of that instance should be reset on the
port.

Change-Id: Ie1516c299ce6d79faf2d5103a14d6d8931d3ede2
Closes-bug: #1321381
(cherry picked from commit 803d59e9f409a59403b2ce55040acc02e14eee28)
Bump stable/icehouse next version to 2014.1.2

Change-Id: Id7181755d3609c0ae91c2402b34f2de02c06a1f0
Merge "Failure during termination should always leave state as error()" into stable/icehouse
Merge "Use no_timer_check with soft-qemu" into stable/icehouse
Use default rpc_response_timeout in unit tests

During running of tox the system can timeout on slower systems.
We have seen this occur in our internal tests and have seen
better results when we increased the api timeout from 15 to 60
seconds.  This can be used until faster hardware is availale
or a better fix is proposed.  Andrew Laski first proposed
this fix.

Closes-Bug: 1311778

Change-Id: I33da328e7bea8fbdde3f01ee0147b4c5a3a278d2
(cherry picked from commit dead965a4398d5093426cf21d2875b55a451e671)
Fix the wrong dest of 'vlan' option and add new 'vlan_start' option

* Allow to specify vlan tag when create nova network, the dest of vlan
option should be 'vlan' instead of 'vlan_start'
* Provide new option 'vlan_start' when create nova network
* test case is updated.

DocImpact
Closes-Bug: #1288609
Change-Id: I8dd858e4cf17d8f689613554d1fbc3e56f220886
(cherry picked from commit e251535eaa7c6a564eddb9218de177c9bea656bb)
Avoid referencing stale instance/network_info dicts in firewall

This makes the virt.firewall code cleaner in terms of referencing
the cached instance and network_info code it stores. Before this
patch, concurrent instance operations could modify these two dicts
so that while we're iterating instances, the network_info dict
is suddenly missing information we need.

The right fix for this is to use instance objects and their
associated info_cache objects, but that's a larger fix and one
not as well-suited to backporting to previous releases which
suffer from this as well.

The approach taken here is that we store the instance and
network_info cache together in the same dict that we can pop()
from atomically (this is not really necessary, but helps to
prevent introducing more of these cases). When we iterate over
the contents, we iterate over a copy of the keys, being careful
not to let a suddenly-missing key break us, and passing the
details all the way down the stack instead of having deeper calls
hit the cache dicts again.

Conflicts:
	nova/virt/firewall.py

Change-Id: Ib1cfd68fca7789ca4a3602c25e6b8a956303fff9
Closes-bug: #1182131
(cherry picked from commit 72dd81343e73baf838bc58d413413f0d57018f15)
Merge "Cleanup allocating networks when InstanceNotFound is raised" into stable/icehouse
Merge "Fix the wrong dest of 'vlan' option and add new 'vlan_start' option" into stable/icehouse
Merge "Use default rpc_response_timeout in unit tests" into stable/icehouse
Instance groups: add method get_by_hint

In order to support backward compatibility a new method
'get_by_hint' has been added. This method will check if the
hint is a uuid and if no it will return get_by_uuid else it
will return get_by_name.

Change-Id: I728bf3454dc5a5367e21f242281719c1a967269a
Partial-bug: #1303360
(cherry picked from commit bff8604fd27fee588facbd429aaedcf227cd5871)
Scheduler: enable scheduler hint to pass the group name

Commit ea6d8403bdc3c1d3ede87a2ed1c8740420c32080 partially
dealt with the problem. The actual scheduling would fail when
the group name was passed.

Change-Id: I668621770e59504164af9a2e861a59e900300bba
Closes-bug: #1303360
(cherry picked from commit a2059b67b207d908b1c65c78dd806b1f5e79582d)
Make sure domain exists before referencing it

Before calling domain.destroy() in the exception handler for a failed
create attempt, make sure domain was created prior to when the
exception was thrown.

Conflicts:
        nova/virt/libvirt/driver.py

Change-Id: I3b7c5afce7f3bacce1b444c245b035334962ff7c
Closes-Bug: #1326998
(cherry picked from commit 5a98983e87e5020626db2e319f7b00ae547ae8e1)