Enable security group extension in PLUMgrid plugin

Implements: blueprint plumgrid-neutron-security-groups
Change-Id: I30392adff5e3250a1c4f9f1f04fc7e0587007226
Use mod_version to clean-up apache version matching

This change uses mod_version (shipped by default on everything we care
about) to set-up version-specific config within apache rather than
within devstack scripts.

Clean up the horizon and keystone config file generation to use the
internal apache matching.

Since I6478db385fda2fa1c75ced12d3e886b2e1152852 the apache matching in
'functions' is actually duplicated.  just leave get_apache_version in
lib/apache as it is used for config-file name matching in there.

Change-Id: I6478db385fda2fa1c75ced12d3e886b2e1152852
Function for auth_token middleware config

Each project was configuring the auth_token middleware using several
lines of inisets. Since all the projects should configure the
auth_token middleware in the same way create a function and call it.

Change-Id: I3b6727d5a3bdc0ca600d8faa23bc6db32bb32260
Configurable token hashing algorithm

The Keystone server and auth_token middleware were enhanced to
support a configurable hash algorithm.

With this change, the user can set

 KEYSTONE_TOKEN_HASH_ALGORITHM=sha256

in their localrc to use the SHA256 algorithm rather than the
default md5. Any hash algorithm supported by Python's hashlib can
be used. The MD5 algorithm doesn't provide enough protection from
hash collisions and some security standards mandate a SHA2 hash
algorithm.

Change-Id: I8b373291ceb760a03c4c14aebfeb53d8d0dfbcc1
Closes-Bug: #1174499
Use correct WSGI dir on SUSE distros

The current default (/var/www) leads to:

AH01797: client denied by server configuration:
/var/www/keystone/admin

For /var/www the needed permissions on SUSE are not set.
For /srv/www/htdocs/ the permissions are correct on SUSE systems.

Change-Id: I3f2df896daecdfe510d45ff121af2a8433a4d5be
Merge "Function for auth_token middleware config"
Merge "Configurable token hashing algorithm"
XenAPI: stackrc now depends on nproc

Install it automatically in the devstack DomU

Change-Id: Ie282dd128ebc92377d85800585962bc8767483fe
Remove the Cisco Nexus monolithic plugin support

The Cisco Nexus monolithic plugin does not work without the Open
vSwitch plugin. The Open vSwitch plugin is scheduled to be removed
as per #1323729. This patch removes the Nexus Hardware switch
related code from devstack. The N1KV virtual switch related code
will still remain in the tree as it doesn't depend on Open vSwitch
plugin.

Closes-Bug: #1350387
Change-Id: I82ebb09c64589fc9b7bb790982541bc87c66e6e3
Update Horizon Neutron-related settings

- Horizon no longer has "enable_security_group" setting
  so we need to remove it.
- There is no need to set enable_lb/firewall/vpn to True
  when q-lbaas/q-fwaas/q-vpn is enabled because Horizon now checks if
  Neutron ext-list and enables corresponding dashboards accordingly.

Change-Id: I37073d73e4cba0103ab1a3d935302f1cd0ef73c5
Merge "Use correct WSGI dir on SUSE distros"
Merge "XenAPI: stackrc now depends on nproc"
Configure endpoints to use SSL natively or via proxy

Configure nova, cinder, glance, swift and neutron to use SSL
on the endpoints using either SSL natively or via a TLS proxy
using stud.

To enable SSL via proxy, in local.conf add

ENABLED_SERVICES+=,tls-proxy

This will create a new test root CA, a subordinate CA and an SSL
server cert. It uses the value of hostname -f for the certificate
subject. The CA certicates are also added to the system CA bundle.

To enable SSL natively, in local.conf add:

USE_SSL=True

Native SSL by default will also use the devstack-generate root and
subordinate CA.

You can override this on a per-service basis by setting

<SERVICE>_SSL_CERT=/path/to/cert
<SERVICE>_SSL_KEY=/path/to/key
<SERVICE>_SSL_PATH=/path/to/ca

You should also set SERVICE_HOST to the FQDN of the host. This
value defaults to the host IP address.

Change-Id: I36fe56c063ca921131ad98439bd452cb135916ac
Closes-Bug: 1328226
Remove Nova v3 API endpoint

Nova v3 API has disappeared in Juno cycle, and we don't test the API
now on the gate since If63dcdb2d05aa0fab0b6848a1248b6678f1ee9ad .
This patch removes the endpoint of Nova v3 API.

Change-Id: I85f87b37558a15d1eaaa781b02fec5b02bd2ab44
Merge "Use mod_version to clean-up apache version matching"
Fix pkg name for mysql-connector-python on SUSE

The correct package name on SUSE distros is python-mysql-connector-python.

Change-Id: I5250356f782f149f87f3d0ffba3380911fa437be
Cleanup nova-cinder nova.conf section

Stop using deprecated conf names, don't override default values with
default values.

Change-Id: I2c7e0833a61926b9fc9b5de4e38fdd626501d78d
Stop setting nova.conf settings that mean nothing

* DEFAULT.fixed_range isn't a valid option in nova anymore
* DEFAULT.osci_compute_workers was never a thing, it should be
  DEFAULT.osapi_compute_workers

Change-Id: Ib08f3e20e4685b331385431276f890205fa76da6
Merge "Update Horizon Neutron-related settings"
Merge "Remove the Cisco Nexus monolithic plugin support"