Use right PKI defaults

The common cookbook has been updated to make PKI the default token
provider in keystone. This patch updates the specs to match that.

The default PKI key size is double what the default value in the
cookbook is. This patch updates it.

Change-Id: Ic17c572f7aa67f88b8f6f2ed31968d043f1abb73
Partial-Bug: #1312927
Allow token signing key/cert/cacert to be pulled in remotely

Currently, we run a pki_setup if auth strategy is 'pki' (default).  If
you have multiple keystone nodes load balanced, they'd all have
different keys/certs/cacerts (created by the pki_setup).  This change
allows you to pull in a custom key/cert/cacert so that these files can
be uniform across all nodes.

Change-Id: I8f0fa41e4433e3a44247fc467e3f6b5f0d2e203d
Allow packages to be updatable

In order for package updates to occur, package resources need to use
the upgrade action.

Change-Id: I39469096c6965731befa443c56968820ec97dc20
Implements: blueprint allow-package-updates
Merge "Allow packages to be updatable"
Only manage the keystone-paste.ini if specified

There are no attributes in this template file, which means it just
overrides the existing keystone-paste.ini, and needs to be updated for
each release.

Additionally, the current template file adds in options that are listed
as deprecated, resulting in warnings in keystone.log. Removing the
template file will mean the packaged keystone-paste.ini is used.

This patch removes the keystone-paste.ini template and adds an attribute
to allow a keystone-paste.ini file to be specified.

Change-Id: Id2e6df82acea480320eaf3d07c0570802e4424ca
Closes-Bug: #1313828
Add ability to override endpoint creation

For new endpoint creation, only there's no endpoint with the
same region name and service id existing, the creation will
be executed.

closes-Bug: #1313690

Change-Id: Ib287f92f1ac9e75fb258381efe387a083d11efc6
Merge "Only manage the keystone-paste.ini if specified"
Re-ordering keystone templates.

Currently, if not using templated catalog backend or using a remote
keystone-paste.ini, service(keystone) does not get restarted before the
registration recipe gets called. This causes keystone user/tenant/role
bootstrapping to fail. This re-ordering resolves this issue.

Change-Id: I97c81b3086a687b28cd8ce329ec70c461c5b73b4
Closes-Bug: #1316732
Merge "Add ability to override endpoint creation"
Merge "Re-ordering keystone templates."