use os-svc-enable to enable openvswitch

Unkike RHEL/Fedora, Debian/Ubuntu OVS package is called
openvswitch-switch. os-svc-enable can use map-services to
deal with the problem.

This change requires patch I2748a9db7f8ee456698187a9646bc7cda2256fe7.

Change-Id: I6e3df30dc3a6918f3a949a7dac47289ede5c3d1f
Update the cinder-lio element to use the venv dir

This updates the cinder-lio element to make use of the
CINDER_VENV_DIR variable which is set by the cinder element.

This allows source installs of this element to work correctly
when using common-env or a custom Cinder venv directory.

Change-Id: Idb8a97180045869595416cf0b17aec70a63d9055
Add local_bind flag to my.cf

This change enables the MySQL configuration file's network socket
bind to be changed from 0.0.0.0, to the local-ipv4 address via
the heat template.

    mysql:
      local_bind: true

The absence of the option will result in the bind returning to
the default of 0.0.0.0. This change was implemented this way
so the changes to the heat template could land later.

Change-Id: Iac1274cc52014f25887d696261b32146afc926dd
Add proxy-logging to proxy-server pipeline

This change enables proxy server logging i.e. add proxy-logging
(x2) to the proxy server pipeline and includes the proxy-logging filter
to proxy-server.conf.

Change-Id: I80ce0ae002eb58b420bddc253ca186d2147c2000
Permit non-loopback guest access to Rabbit.

Recent versions of RabbitMQ have defaulted to only permitting the guest
user to connect from the loopback address.

Many elements have yet to consume rabbit accounts - until the configuration
of per-service (or per-server) accounts is finalised, ensure that newer
rabbit versions will be backwardly-compatible with the old behaviour.

Change-Id: I30e0156862c5672aef3e31a6919c8fe1957e3a02
Related-bug: #1315474
Related-bug: #1317778
Use keystone.host in stackrc

/root/stackrc has a hardcoded value of localhost for OS_AUTH_URL,
which doesn't help when we can't talk to it due to VIP changes. Set
it to keystone.host.

Change-Id: If952f383e8970e3298c36cdd750f6c6a20209e81
Set the MAC address for ensure-bridge bridges

We're seeing the bridge sometimes not glue to the right port address.
The defined behaviour is to dynamically change the MAC based on
attached ports and as we need DHCP to work, we should set the MAC to
the MAC that Neutron expects.

Co-Authored-By: Michael Kerrin <michael.kerrin@hp.com>
Closes-bug: #1329238
Change-Id: I87302d468784a9c9d1703f485031016f87d57873
Fix Fedora builds on Ubuntu

Change Ibffa1b986b52a1dc28de8d3b8056eed92aae9ee7 broke Fedora
builds on Ubuntu. The problem is load_policy has no policy to
load in Ubuntu.

Using the -N option with semanage fcontext removes the need to
load the SELinux policy.

Change-Id: Ie2289e75bb4a7f1240916c613e500f512937283d
Closes-Bug: 1347295
Bump the size of the squid cache_dir.

We were seeing disk space over limit errors on our CI
squid cache box:

 WARNING: Disk space over limit

So bumping the the cache_dir sizes to 4 Gigs...

Also switching to aufs for async IO.

Change-Id: I560decfe0d4770577141a43c4f16f7ead76ad2d4
Add passthrough to etc/swift.conf

Allowing passthrough to be used to add swift storage policies.

Change-Id: Ica4ef7ad6b4356f7f8e987465d29c46a5a95b1e2
Adding haproxy reload check

When an initializing controller node restarts haproxy as part of the
initialization sequence, and that node happens to be in control of
the VIP address but is not the bootstrap node, then the initial
cluster initialization sequence can fail.

This commit changes the haproxy script such that if haproxy is
running, then it is reloaded instead of restarted.

Change-Id: I1b35d3ebdb08e175fb0fd58c0c395b7b30103b4b
Closes-bug: #1348931
Add new multipath element

Provide an element that provides multipath support allowing a user to
configure multiple I/O paths to storage devices. Typically used with
SAN storage arrays.

Change-Id: I2f970399109b1396c25cb6e2ef2906310d04c5f8
Compile and install custom SELinux policies

Provides a way to compile and install custom SELinux policies
to images. Custom policies are placed in a custom-policies
directory. An install.d script will copy the files to
/opt/stack/selinux-policy. When an instance boots, an o-r-c
script will compile the policy source files in that directory
and then load them.

When SElinux is in enforcing mode in the ci, you would need to
create a custom SELinux policy to temporarily fix an upstream
issue to allow ci to pass before that issue has been fixed in the
upstream SELinux policy.

Change-Id: I1cda87e980522f6c668debcf85668bb631d070b3
Merge "Add proxy-logging to proxy-server pipeline"
Merge "Use keystone.host in stackrc"
Allow keepalived to load kernel modules

Toggle a SElinux boolean to allow keepalived to load kernel modules
when SELinux is in enforcing mode.

Closes-Bug: 1342872
Change-Id: I8b53ade65426c132e4200e0cbd6800ee9e59f00f
Enable haproxy_connect_any port access

Enable a boolean to allow haproxy to proxy any port. If not set,
SELinux, in enforcing mode, denies haproxy access and haproxy will
fail to start.

Closes-Bug: 1339938
Change-Id: Ic7980285d2aa678315d73295226508fcf2de40f8
Custom policy for ssh-keygen failure

This patch contains a custom policy to allow ssh-keygen to write to
/tmp. This action is blocked by SELinux. The custom policy is needed
until the upstream SELinux policy is updated for Fedora or nova is
modified to call ssh-keygen to write out to a different directory.

Partial-Bug: 1284485
Change-Id: I59de4e88d9343e093a95436432e2e4d68f425d06
Custom policy for nova-api tmpfs errors

This policy fixes an issue whereby nova-api is unable to use tmpfs,
/dev/shm, when SELinux is running in enforcing mode.

Partial-Bug: 1342863
Change-Id: I51d2afbd89c4f632920eca6d2d1698665ccf4e21
Ensure Cinder uses the VIP when contacting Glance

Updates cinder.conf so that it will set glance_host and glance_port
with data from heat template.

Change-Id: I2b6aebf782b0825b4a980b22763e04dc79593efa
Closes-Bug: 1351110