updated pacemaker/neutron.pp manifests to do ovs/netns cleanups.

Using ocf scripts the cleanups handle the cleanup of agent
resources (qrouter, qdhcp, etc..) when those are migrated to
different hosts.
BZ #1120602 - Add neutron-agent-cleanup ocf resources to Pacemaker config.

https://bugzilla.redhat.com/show_bug.cgi?id=1120602

The quickstack resource wrapper is needed for the previous patch to work properly.
BZ #1128457 - Horizon dashboard -> Not Found

https://bugzilla.redhat.com/show_bug.cgi?id=1128457

Fix 404 on horizon dashboard.

Same fix as posted for packstack (thanks ichavero):
https://bugzilla.redhat.com/show_bug.cgi?id=1129379
https://review.openstack.org/#/c/113592
Merge pull request #350 from cwolferh/bz1128457_apache_fqdn_fix

BZ #1128457 - Horizon dashboard -> Not Found
BZ #1123301 - nova-metadata VIP/listener is missing on port 8775 in haproxy.cfg

https://bugzilla.redhat.com/show_bug.cgi?id=1123301

This was already in the puppet, but had been disabled for a previous release.
This patch re-enables it to see if it now works as expected.
BZ #1123301 - add metadata_listen param

https://bugzilla.redhat.com/show_bug.cgi?id=1123301

Otherwise openstack-nova-api attempts to listen on 0.0.0.0,
causing the error:

ERROR nova.wsgi [-] Could not bind to 0.0.0.0:8775
CRITICAL nova [-] error: [Errno 98] Address already in use

(cherry picked from commit 73a342aeabb03d66d7a26e508183c90ddf72f468)
Merge pull request #336 from jguiditta/bz1123301-nova-metadata-haproxy

Bz1123301 nova metadata haproxy
BZ#1122701 - Incoming ports are wide open

https://bugzilla.redhat.com/show_bug.cgi?id=1122701

Uninstall firewalld. The firewall puppet module will then take care of
installing iptables-services package and enabling and starting of
iptables. Default firewall rules will then be present.

Moving the disabling of firewalld to firewall::common so that it's
also ran for the Gluster server host group.
Merge pull request #323 from jguiditta/ajo_fixes

Add neutron-agent-cleanup ocf resources for pacemaker
BZ #1128361 - Correctly check for openstack-heat-engine service

https://bugzilla.redhat.com/show_bug.cgi?id=1128361

Use Quickstack::Pacemaker::Resource::Service instead of Exec to check
that heat engine is up
Ensure iptables runs before setting firewall rules

It used to happen that some firewall rules tried to be created before
iptables service was actually running, resulting in failure to create
the rules and printing warnings like:

Warning: Firewall[001 apache incoming](provider=iptables): Unable to persist firewall rules: Execution of '/usr/libexec/iptables/iptables.init save' returned 1:

This issue specifically appeared for apache, nova, and glance firewall
rules on the HA controller.

After updating firewall module, the warnings were not printed but the
iptables service was still getting started after some firewall rules
were defined by Puppet, and this caused the system default firewall
rules not to be present at all.

It seems we need to add ordering on every firewall resource definition
to really ensure that iptables service is started before the first
firewall rule is defined by Puppet.
Merge pull request #352 from bcrochet/bz/1128361

BZ #1128361 - Correctly check for openstack-heat-engine service
Merge pull request #329 from jistr/iptables_basic_rules

[OPTION 2] BZ#1122701 - Incoming ports are wide open
BZ #1125301 - Add heat-engine to cloudwatch colo constraint

https://bugzilla.redhat.com/show_bug.cgi?id=1125301

Add a colocation constraint from heat-engine to heat-api-cloudwatch

jayg: changed resource name to 'openstack-heat-api-cloudwatch-clone' and verifed
functional.

Signed-off-by: Jason Guiditta <jguiditt@redhat.com>
Merge pull request #353 from jguiditta/bz1125301-heat-colo

BZ #1125301 - Add heat-engine to cloudwatch colo constraint