Work around keepalived split brain

When a host reboots, it's possible for keepalived to come up whilst
the host's network is still being reconfigured (which happens
asynchronously). This can cause the netfilter it puts in place to
fail to see announcements from other members of the cluster,
convincing it to bring up the VIP when it already exists on another
host.

The approach here is crude: every five minutes we cause a reload of
keepalived's configuration, which has the side-effect of making it
reappraise its netfilters and regenerate them.

This is a stopgap measure whilst the underlying causes are bottomed
out.

Change-Id: Ic0397d79465869b78a72faef8653aedee321a3e2
Partial-fix: 1367742
Make sure that keystonemiddleware package is installed

With I58dad8e1151067bf8df37e511fff5fc0e3dfb487 we switched from
obsolete keystoneclient to keystonemiddleware, make sure that proper
package is installed too.

Change-Id: Ifee489dbb52d4ae401d010d34ca5e244ea3e08e3
Correct slo middleware position swift proxy-server pipeline

The recommended position for SLO middleware has changed
in Swift (see change ID I7827dd2d9dfbb3c6424773fb2891355d47e372ba).
This change updates the swift proxy-server pipeline to move SLO
middleware to the correct position.

Related-Bug: #1315133
Change-Id: If52935ec7986adec67bb190a4509c8a8c35056c9
Configures novnc proxy to listen on local-ipv4

Currently novnc proxy listens on all interfaces. This patch changes
it to listen on the host management interface (local-ipv4) like the
rest of the nova services. This is a pre-requisite to making vncproxy
sit behind haproxy and stunnel.

Change-Id: Iba3e35165a1e842ce0fc604ec92ddbd0009e99c2
Configure logging for keepalived

Redirect keepalived logs to /var/log/keepalived/keepalived.log and
allow configurable dump_conf and log_detail to increase logging

Change-Id: I8afbcf883d8a95a7a1fb8fd3bda67a00c801a899
Load the storage roles in Tuskar if they exist

Change-Id: I2b0775b1da85197edb06c3d7b130a42a8ee68ea9
Associate default images to storage roles

Tuskar UI needs images associated by ID.

Change-Id: I651362df48592b3455007a4cddabff3d52ca055c
Remove all first-boot.d references

first-boot.d has been deprecated for two releases so is about
time to remove any references to it.

Change-Id: Id8415447592be9fb3fd009dc528aed3c42b6095d
SELinux: Fix keepalived killall denials

A custom policy to temporarily fix the killall denials until the
upstream SELinux policy and keepalived packages are updated.

Change-Id: Ie0d8529d22fc39acaede8a3f1985c50ead76f1f3
Partial-Bug: 1379079
SELinux: swift denied access to /var/lib/swift/.local

Swift services cannot search /var/lib/swift/.local. This is a
custom policy to allow search for swift until the upstream SELinux
policy is updated.

Change-Id: Ie6197cc63597e29f0e84f97d67b1935c67e54a53
Partial-Bug: 1379081
Fix os-svc-install

The 'a' option was missing from the getops set of available options
in os-svc-restart.  This is causing CI failures in patces with an
"illegal operation -- a" error.[1]  This patch adds the 'a' option
to os-svc-restart.

[1] Ib3bc5c47de1b8bb6006530d56e9d47c3763af7b5

Change-Id: I527c5b0cda0cda7877d23422702517760c1bf340
Support Debian distro for iptables

We currently use the add-rule script to create iptables rules that allow
the cloud we deployed to function.

These iptable rules are required on RedHat based distros that have a
default deny-all policy; but they're also useful on Debian distros if
the operators turn on a deny-all policy as part of locking down their
environment. It would be useful if these operators could leverage the
work RedHat has done to get the Debian distro working.

This change adds a check for Debian and allows the add-rule script to
run, as a first step towards full support for Debian-based distros.

Also, install.d installs iptables and there is a Debian specific change.

Change-Id: Iea773d37b18c15a417896e93e29bcdc1e20096ac
Closes-Bug: #1351412
Add ability to enable debug logging on seed

Because our seed uses a static config json we require special logic to
enable debug logging on it.

Change-Id: If38d9947e6e70ce537219caf1e2835285351d960