Configure libgfapi access when cinder_backend_gluster is set

Setting qemu_allowed_storage_drivers=gluster in the nova config causes
libvirt/qemu to mount gluster volumes via libgfapi.
updated pacemaker/neutron.pp manifests to do ovs/netns cleanups.

Using ocf scripts the cleanups handle the cleanup of agent
resources (qrouter, qdhcp, etc..) when those are migrated to
different hosts.
BZ #1120602 - Add neutron-agent-cleanup ocf resources to Pacemaker config.

https://bugzilla.redhat.com/show_bug.cgi?id=1120602

The quickstack resource wrapper is needed for the previous patch to work properly.
BZ #1123300 - haproxy check options missing interval parameter

https://bugzilla.redhat.com/show_bug.cgi?id=1123300

From BZ: "HA: all "check" options are missing the interval
parameter. This can cause higher recovery times in case of failure."
BZ #1123314 - pacemaker heat op monitor interval to 60s

https://bugzilla.redhat.com/show_bug.cgi?id=1123314

From BZ: "Rubygem-staypuft: HA: Relax the openstack-heat-engine: op
monitor interval to 60 seconds.

Now it's openstack-heat-engine: op monitor interval=30s

appears to be too resource consuming in some cases (like
openstack-heat-engine and causes false positives."
Merge pull request #338 from cwolferh/bz1123314_heat_pcmk_interval_to_60s

BZ #1123314 - pacemaker heat op monitor interval to 60s
Merge pull request #337 from cwolferh/bz1123300_haproxy_inter2

BZ #1123300 - haproxy check options missing interval parameter
BZ #1123312 - increase galera pacemaker start timeout

https://bugzilla.redhat.com/show_bug.cgi?id=1123312

Increase galera start timeout to allow a sufficient amount
of time for syncing to occur between galera modes.
BZ #1129227 - Set l3 external_network_bridge to ''.

https://bugzilla.redhat.com/show_bug.cgi?id=1129227

This is needed to properly use provider networks in newer versions of neutron.
Merge pull request #347 from cwolferh/bz1123312_galera_op_start_timeout

BZ #1123312 - increase galera pacemaker start timeout
Merge pull request #348 from jguiditta/bz1129227-br-ex

BZ #1129227 - Set l3 external_network_bridge to ''.
BZ #1128457 - Horizon dashboard -> Not Found

https://bugzilla.redhat.com/show_bug.cgi?id=1128457

Fix 404 on horizon dashboard.

Same fix as posted for packstack (thanks ichavero):
https://bugzilla.redhat.com/show_bug.cgi?id=1129379
https://review.openstack.org/#/c/113592
Merge pull request #350 from cwolferh/bz1128457_apache_fqdn_fix

BZ #1128457 - Horizon dashboard -> Not Found
BZ #1123301 - nova-metadata VIP/listener is missing on port 8775 in haproxy.cfg

https://bugzilla.redhat.com/show_bug.cgi?id=1123301

This was already in the puppet, but had been disabled for a previous release.
This patch re-enables it to see if it now works as expected.
BZ #1123301 - add metadata_listen param

https://bugzilla.redhat.com/show_bug.cgi?id=1123301

Otherwise openstack-nova-api attempts to listen on 0.0.0.0,
causing the error:

ERROR nova.wsgi [-] Could not bind to 0.0.0.0:8775
CRITICAL nova [-] error: [Errno 98] Address already in use

(cherry picked from commit 73a342aeabb03d66d7a26e508183c90ddf72f468)
Merge pull request #336 from jguiditta/bz1123301-nova-metadata-haproxy

Bz1123301 nova metadata haproxy
BZ#1122701 - Incoming ports are wide open

https://bugzilla.redhat.com/show_bug.cgi?id=1122701

Uninstall firewalld. The firewall puppet module will then take care of
installing iptables-services package and enabling and starting of
iptables. Default firewall rules will then be present.

Moving the disabling of firewalld to firewall::common so that it's
also ran for the Gluster server host group.
Merge pull request #323 from jguiditta/ajo_fixes

Add neutron-agent-cleanup ocf resources for pacemaker
BZ #1128361 - Correctly check for openstack-heat-engine service

https://bugzilla.redhat.com/show_bug.cgi?id=1128361

Use Quickstack::Pacemaker::Resource::Service instead of Exec to check
that heat engine is up
Ensure iptables runs before setting firewall rules

It used to happen that some firewall rules tried to be created before
iptables service was actually running, resulting in failure to create
the rules and printing warnings like:

Warning: Firewall[001 apache incoming](provider=iptables): Unable to persist firewall rules: Execution of '/usr/libexec/iptables/iptables.init save' returned 1:

This issue specifically appeared for apache, nova, and glance firewall
rules on the HA controller.

After updating firewall module, the warnings were not printed but the
iptables service was still getting started after some firewall rules
were defined by Puppet, and this caused the system default firewall
rules not to be present at all.

It seems we need to add ordering on every firewall resource definition
to really ensure that iptables service is started before the first
firewall rule is defined by Puppet.