Server secgroups and network/port together invalid

Nova silently ignores security_groups properties for a server if the
server has a 'networks' property that references a neutron port, the
intent being that security groups are assigned to the port(s).

Adds note to Server properties to this effect.
Validation fails for a Server if 'security_groups' is defined AND
the server has neutron Ports assigned.

Change-Id: I883761a0bb0e73a3fcc7c362d8e6dc5a099806e0
Closes-Bug: #1270313
Order imports in alphabetical order (2/9)

This patch is one in a series to re-enable H306 style check rule
(imports are in alphabetical order). It touches API files.

Implements: blueprint reduce-flake8-ignored-rules (partial)
Change-Id: I81c7c79516ce1a17055c3b9c12a94312ed3d1940
Order imports in alphabetical order (3/9)

This patch is one in a series to re-enable H306 style check rule
(imports are in alphabetical order). It touches common and cloudinit files.

Implements: blueprint reduce-flake8-ignored-rules (partial)
Change-Id: Ie9838dba11323575165fc3bfdfbd0d0b93f653fa
Remove unused variable

o heat/common/config.py:DEFAULT_PORT = 8000

  This variable was removed in the following commit.

    commit 34e47b64d926c055d9895c5b3f27949eaca68999
    Author: Steve Baker <sbaker@redhat.com>
    Date:   Mon Jul 22 16:01:44 2013 +1200

        Move heat-cfn, heat-boto, heat-watch to new repo

Change-Id: Iab6213eba1422882c92bd16a3351df19869aa9f3
Set statuscode=404 in NotFoundException in tests

when resource can'n be found,neutron will set
statuscode=404 in NotFoundException,so add statuscode
in exception to make fake client have same action.

Change-Id: I6597f080903501d9fe6050893054cc7dba6a595b
Add host_routes property to Neutron subnet resource

Template snippet that was functionally tested:

subnet:
  Type: OS::Neutron::Subnet
  Properties:
    host_routes:
    - {destination: 192.168.1.0/24, nexthop: 192.168.1.2}
    network_id: {Ref: network}
    ip_version: 4
    cidr: 10.0.3.0/24
    allocation_pools:
    - {end: 10.0.3.150, start: 10.0.3.20}

(Next hop probably would make more sense to be in the CIDR)

Change-Id: I36f72f006a1ba48a6ed55a1c361b3df8d1359caa
Closes-Bug: #1250710
Make the first line of every file consistent.

Change-Id: I2e1a809cfca8e88693551d58d33e747f54ee5eb1
Add IP address to error message of failed stack

The error message that occurs when the heat-script.sh or cfn-userdata
script runs doesn't include the IP address of the server, and it's not
possible to find that info in the stack-show output of a failed stack.
Add the IP address to the error message so it is displayed in the
stack-show output to aid in debugging.

Change-Id: I35bd4fbc1a05fa8207f3eb4f501f5becf78415c9
Allow proper instance with volume suspension

When suspending a stack that contains an instance with a volume
attached through the instance's "Volumes" property, the stack will
go into a SUSPEND_COMPLETE state, but the actual instance will still
be in an ACTIVE state. This is because check_suspend_complete will
return TRUE without ever starting the instance's suspend task.
This commit ensures that the instance suspension TaskRunner is
actually started.

Change-Id: I77291d21b291242684cf42e7143b264521ba113e
Closes-Bug: #1284306
Allow getting attributes on suspended resources.

A resource which is suspended can legitimately have attributes returned
for it.

Related-Bug: #1286920

Change-Id: I350b2e20e274cce7a0f654cb71f7445632e0e633
Allow handle_signal to assert which actions are valid

This retains the current behaviour for InstanceGroup and Restarter
while allowing other resources to apply different policies about
what actions are allowed when a signal is received. This is needed
by SoftwareDeployment, which can legitimately receive signals
during SUSPEND and DELETE.

Change-Id: I6f694451669b6c9b60b9fbd3ad77d0fc111bbb5a
Closes-Bug: #1286920
heat_keystoneclient add delete_stack_domain_user_keypair

Adds function to delete a credential containing a keypair, since we
do this as admin we also sanity check to ensure the user associated
is a stack domain user, if not we should fall back to the non-admin
path

Change-Id: Ie15958f91b6b80b4a3f0b73943345b7d27566077
blueprint: instance-users
StackUser add suspend/resume support

Adds suspend resume support which will be required to migrate the
User resource to this base class without losing functionality

Change-Id: I3607ef71bfcd863b08879b3856baa92e7aeeef10
blueprint: instance-users
Add test for StackUser._create_keypair

Currently _create_keypair is only indirectly tested via SignalResponder
so add a base-class-specific test.

Change-Id: Ic9f1df06df25205f864b2f0138d2821089608b88
blueprint: instance-users
Allows vip from a different subnet for lbaas resource

This fix allows user to specify a different subnet while adding
a vip to a pool resource. If vip subnet is not provided, pool
subnet is used by default.

Change-Id: I0b7740ca37961ae412866cc15ab439dafbfcf9d9
Closes-Bug: #1286001
Revert "Showing member list for nested resources"

This reverts commit 5e883e94d73cb7fd6737c262f25cd7c6be56ffe5.

Reverted patch not fully resolve problem that was mentioned in bug
description, since presented in resource show ids are owned nested stack
and it doesn't allow use only resource-show command for displaying
information of these resources.
Also this code affects not only resource group resource, but other
nested resources too. So it leads to displaying some unwanted
information.

Conflicts:

	heat/tests/test_engine_service.py

Closes-bug: #1280391
Change-Id: Id965e1f872ebf63a510242c7c76a4f105dcb4a17
Add state check when suspend or resume stack

If suspend a stack which is already suspended,
some resource will throw exceptions.and you can't
suspend or resume that failed resource.

Add stack check when update or resume,if the
state of stack is expecter,return directly.

Change-Id: Ie6859c03168d9d18e88bbeb6df2c646541f2aa9d
Closes-Bug: 1284531
Fix resolving for Ref function

Fix problem with incorrect choicing of Ref class during update.
When we call reparse function in __setitem__ method we use,
old version of stack template. So Ref function cann't find
new 'Resouces' in template.

Closes-bug: #1285067
Change-Id: I82eeeef0c3c626f0ec3df5a827a7ec049929538f
heat_keystoneclient don't pass project and trust_id

When creating a keystoneclient connection with a trust, we should
not pass the project_name, as the token can only be scoped to either
a trust or project, not both.  Previous versions of keystoneclient
worked with both, but recent changes mean this no longer works.

Change-Id: I5c7e7498137d428360f2b5f1e8bd2d079c80cd9b
Closes-Bug: #1288223
Fix HOT set_stack_id

HOTParameters.set_stack_id didn't return True in case of success, which
made the stack prints a spurious warning about not being able to set
StackId.

Change-Id: If8dc76a8588f730fd184abdab0be28e60a34fa99