Always start keystone service when in native mode

https://bugzilla.novell.com/show_bug.cgi?id=859678
Merge pull request #165 from vuntz/bnc859678

Always start keystone service when in native mode
Moved role constraints into model and removed edit deployment

(cherry picked from commit b6becfa8eb113ad5b4a7826192e2d18342b6c532)
Merge pull request #190 from vuntz/release/roxy/master

Moved role constraints into model and removed edit deployment
Removed the single assignment block from constraints
Merge pull request #191 from tboerger/feature/roxy/fix-constraints

Removed the single assignment block from constraints
extract bind_host temporary variable for legibility

Also rename template variable for consistency.
calculate my_admin_host and my_public_host earlier

This will allow us to calculate all service URLs in the same place for
legibility.
add comment about my_admin_host
calculate endpoint URLs more consistently

To clarify the various endpoint URLs in use, it makes sense for
them to be calculated in the same place, and in a consistent manner.
Introducing helper methods facilitates this.
Add trailing slash to versioned service URL

Just to be on the safe side.
drop api_port attribute

The ambiguously named api_port attribute was mysteriously introduced
way back in 1c1f5a51, in which commit it defaulted to 35357 in
attributes/default.rb and defaulted to 5000 in
bc-template-keystone.json.  Clearly this makes no sense.  The
intention seems to have been to use it for the public API endpoints
(which conventionally are on 5000) rather than the admin API
endpoints, and that's what effectively happened due to the proposal
defaults overriding the attribute defaults.  However as a result, it
duplicates service_port, which defaults to 5000 in both files -
Keystone only offers two ports, so it's pointless having three
attributes.

service_port is also the name of the attribute used in the current
upstream:

  https://github.com/stackforge/cookbook-openstack-identity/blob/master/attributes/default.rb

Therefore it makes sense to align with that by dropping api_port.
Add migration script for removal of api_port attribute
service_port and admin_port are both integers
invert conditional for legibility
Implement HA with HAProxy, via pacemaker barclamp

Co-Authored-By: Adam Spiers <aspiers@suse.com>
Use new helpers to get hostnames for endpoints
Add helper to fetch keystone settings that other barclamps need

They will get a nice hash that is easy to use.
Synchronize PKI between nodes
Merge pull request #189 from vuntz/haproxy-roxy

HA with HAProxy