Install dependency python-memcache when token driver memcache.

Token driver backends.memcache requires python-memcache which not
installed by default. As result keystone crash with exception.

Patch install python-memcache when it's need.

Change-Id: I752a97ad9b3135a7336265760f0cd3304e0277b4
Add memcache configs for backend and token

add config for section cache: enabled, backend, backend_argument,
debug_cache_backend

add config for section token: caching

use default config values as project keystone/master

also add missing dependency service 'memcached' before 'keystone'

Change-Id: I5520840aa1736fd90ecc854bd873c498f79658e4

Conflicts:
	manifests/init.pp
Add service validation and encapsulation

This patch moves the keystone service resource
to a new class, keystone::service, and adds
a new resource that uses the admin credentials
to confirm the keystone server is accepting
connections and functioning well from the client
perspective. This validation resource is optional
and if specified will be required by all keystone
custom types.

In order to take advantage of this change, consumers
of the keystone service should depend on this class
instead of the keystone service.

Change-Id: Ibd92a7c40658bb242b3b55980489949cb5835145
Make service provider as changeble incoming parameter.

This change need for using Keystone with alternative service systems.
For example -- a corosync/pacemaker clustering solution. or another.

Change-Id: I4b7fe3e1a25d1017c53726cf8ce69338d060beb7
SSL for communication between keystone and rabbitmq

Currently, Keystone can not be configured via Puppet to communicate with
rabbitmq using SSL. Most other puppet component already have this feature.
This commit enable this feature for Keystone.

Change-Id: Idd207a58a71c001e581d17c5b97965189e20869f
Use secret parameter for rabbit_password

Rabbit_password configuration was not using secret parameter so it
was visible on the logs.

Change-Id: Idad892f0c461fce53eaa81ec8a7f3cfe871a9d00
Closes-Bug: 1328448
Prefix database parameters with database_ for consistency

Although database configurations were moved to the new database
section, parameters were not renamed accordingly.

This change renames those parameter for consistency with the other
modules and actual database configuration names.

Change-Id: I34855839963faa4c60f482df014b4986c7acab92
Explicitly setting of PKI token signing cert

Enable setting of the cert, key, and cacert for PKI token signing.

Replaces abandoned change https://review.openstack.org/#/c/93598

Change-Id: I91f1c3c6f2d1fcb477699b2b23b56cbe22006d4e
Closes-Bug: #1319470
Fix usage of admin_endpoint

The admin_endpoint in keystone.conf is used
to advertise for service discovery to a client, and
should not contain the identity version as this will
be appended based on which versions are available.

This patch changes the behavior of the native types that
depend on admin_endpoint and the service validation to
accept a url without a version appended. In both cases,
the version will be set to v2.0, as there is no suitable
conf option in keystone.conf from which the available
versions can be deduced. This allows the correct, versionless
admin_endpoint to be set in keystone.conf for the service
itself.

Change-Id: I0c1ebd9f1cf452828698555e7c642fac770aa73f
pki-setup should be run regardless of token provider

The puppet-keystone module currently will only execute
'keystone-manage pki_setup' to create the signing key if the PKI
token provider is being used. The signing key/cert is still used
for signing the token revocation list, even when the UUID token
provider is being used. We should be running
'keystone-manage pki_setup' if enable_pki_setup=true, regardless
of token provider.

Change-Id: I2817fbde74cbd50cae31f681503816e576cc7b60
Closes-bug: #1373064
setup keystone using apache mod_wsgi

Allow keystone to be set up to use apache mod_wsgi as the server
instead of a standalone eventlet service.  There is a new keystone
class parameter: service_name.  The default is 'keystone', which will
set up the standalone eventlet service.  If 'httpd' is used, the
keystone class will skip creating the keystone service, which also means
no 'openstack-keystone' service.  The class 'keystone::wsgi::apache' is
then used to configure apache mod_wsgi to serve keystone.

Had to remove the File resource default in the keystone class.  When
using wsgi::apache, the apache class and other classes are included.
Since puppet uses dynamic scoping, this overrides the file resources
in those classes as well.  keystone now explicitly sets all of the
parameters in files/directory resources.

Change-Id: Ib05ac81381e169845b44b2ef7cb810a4d5db17de
Closes-Bug: #1348728
Fix service keystone conflict when running in apache

service keystone is started after the package is installed. When
running keystone inside apache, we must ensure service keystone
is neither running nor start at boot.

This fixes error of apache during start: 'Address already in use:
make_sock: could not bind to address host:35357'

Change-Id: Ie761450ea05a0c92e595b12d1c7ced9481eb967c
Update httpd/keystone for icehouse

Update files/httpd/keystone.py to date with current version from
project keystone, branch stable/icehouse

This file is used by apache to start keystone as wsgi service.
But at the moment this file is not installed by canonical package
keystone and we have to deliver it via puppet until they include
in the package

SMBCAP-5552
Add more config options for pki signing

* add config signing/cert_subject
* add config signing/key_size
* use default values from keystone

Change-Id: Ie327b8ca4f0f8026582530a9aefe5f0d184f92e2
Merge pull request #2 from TelekomCloud/feature/apache_pki_memcached

Tuning Keystone Performance