Add API schema for v2.1/v3 migrate_server API

By defining the API schema, it is possible to separate the validation
code from the API method. The API method can be more simple.
In addition, a response of API validation error can be consistent for
the whole Nova API.

Partially implements blueprint v3-api-schema

Change-Id: I9f1eea8471af0f86dcf472ed8a4fdb634dfdb260
Add API schema for v2.1/v3 create_backup API

By defining the API schema, it is possible to separate the validation
code from the API method. The API method can be more simple.
In addition, a response of API validation error can be consistent for
the whole Nova API.

Partially implements blueprint v3-api-schema

Change-Id: Ie8a1ce6d0d7b90fb73555981fa974e9029344d3b
Add API schema for v2.1/v3 attach_interfaces API

By defining the API schema, it is possible to separate the validation
code from the API method. The API method can be more simple.
In addition, a response of API validation error can be consistent for
the whole Nova API.

Partially implements blueprint v3-api-schema

Change-Id: I0c4066c34f6da0934946aa9eda907b911dbede16
VMware: remove duplicate key from test_instance dict

Remove the duplicate 'node' key from test_instance dict

Change-Id: I1199b5f9428f3fad196bd10331b268f9a3eddcf9
Add 'anon' kwarg to FakeDbBlockDeviceDict class

This will allow us to create fake block devices without the database id
field, so we can pass them to BDM objects in our test  which can then
call create(). create() would normally error out if there is a DB id set
on the object.

Change-Id: I2d1f975633c8b2cb9e2e744c5f769b8f753b5968
change the firewall debugging for clarity

When we are building rules ensure we log the instance['id'] so
we can actually correlate the iptables output to UUID for the
instance.

Also bundle up the security group to iptables translation to a
final view of the world instead of the piecemeal rule at a time
view.

Display what rules are being skipped in the add process, as the
skips seem to happen a lot. If this is completely normal we should
probably delete the bit entirely at some later point.

Related-Bug: #1298472

Change-Id: I0e90c3af9bf908b733ed895ad7c204b0a95ef786
Retry db.api.instance_destroy on deadlock

Update the instance_destroy method of the sqlalchemy db API to retry if
it fails because of a deadlock. The decorator that handles this was
introduced in I0293c62d2dd5ac036445bc639cabbd05ba016e83.

This patch does not include a unit test for this bug, as deadlocks are
very hard to reproduce.

Change-Id: I570d91e892a6e1ff4b3cdb8cf81acc483649835e
Closes-Bug: #1342086
libvirt: add version cap tied to gate CI testing

Limit the libvirt features that Nova will use in a default
configuration to only those which are tested in the CI gate.

The end user can override the limit if they wish to opt-in
to use of untested features via the 'version_cap' setting
in the 'libvirt' group.

Change-Id: Ib91164cc572b1dbde2a31beee5751c52b0445d3e
libvirt: fix recent test changes to work on libvirt < 0.9.13

The newly used 'listAllDomains' method was only introduced in
libvirt 0.9.13. Although the driver code was written to cope
with older libvirt, the test suite code itself would fail
when faced with such an old libvirt because it was trying to
mock out methods which did not exist.

The fix here recognises that since '_list_instance_domains_fast'
and '_list_instance_domains_slow' both have explicit test cases,
there is no point in mocking out the low level 'listAllDomains'
method in all the other test cases. Instead we can mock out
the much higher level '_list_instance_domains' which means we
avoid any interaction with libvirt in these test cases. The
opportunity is taken to convert the tests in question to use
'mock' instead of 'mox' since it also simplifies the code.

Finally in the test for '_list_instance_domains_fast' simply
skip the test if libvirt is too old to have the required
constants defined.

Closes-bug: 1341729
Change-Id: I554352ea14e6b3306176e7524502e005cebd8c16
Move injected_network_template config to where it's used

The config is used by netutils, so netutils should be the place where it's
defined.

Change-Id: I8ec317481dc7da299225ac605f90b146e7a6d98b
Avoid possible timing attack in metadata api

Introduce a constant time comparison function to
nova utils for comparing authentication tokens.

Change-Id: I7374f2edc6f03c7da59cf73ae91a87147e53d0de
Closes-bug: #1325128
move the cloudpipe_update API v2 extension to use objects

This change converts the cloudpipe_update extension to use the Network
object instead of direct database access.

Related to blueprint compute-manager-objects-juno

Change-Id: Ie4f800e05dae9aafd6f0f11ef0f2cd9ecf0d3215
Merge "Add API schema for v2.1/v3 attach_interfaces API"
Merge "Add API schema for v2.1/v3 migrate_server API"
Merge "Add API schema for v2.1/v3 create_backup API"
Make sure that metadata handler uses constant_time_compare()

This adds a test to ensure that the new behavior of the metadata
API handler persists. It's important that it uses the special
constant_time_compare() method.

Change-Id: I1253661f74dae822be9dc9fe1fdab861ebd64bc9
Merge "Move injected_network_template config to where it's used"
Merge "libvirt: add version cap tied to gate CI testing"
Merge "move the cloudpipe_update API v2 extension to use objects"
Merge "Add 'anon' kwarg to FakeDbBlockDeviceDict class"